MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 f46d61129fce27a1da5e4c47d3b7e515cb101878722f57f515df14b061e13af1. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


ZeuS


Vendor detections: 7


Intelligence 7 IOCs YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: f46d61129fce27a1da5e4c47d3b7e515cb101878722f57f515df14b061e13af1
SHA3-384 hash: d6219274f2b887eb487f7759af9dc3694fd018f6324a1f7f262a0a207352197fadc873ea39671c66ccaec4c70ecd7c26
SHA1 hash: 4cd24945ff6b1370ee87d67e8a28e2c4d5d8abb2
MD5 hash: 4e158fac7081b72dd4eb36ce12d51887
humanhash: eleven-bulldog-fillet-charlie
File name:f46d61129fce27a1da5e4c47d3b7e515cb101878722f57f515df14b061e13af1
Download: download sample
Signature ZeuS
Create hunting rule
File size:466'945 bytes
First seen:2020-08-02 16:13:03 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash e9a2281edb8d1ee1ebed4e02e6000104 (1 x ZeuS)
ssdeep 12288:yzbSYgF6yCv1wzgRPOVLNBxTFCc2RP+TsE:yzbSYgF6yCvRELNBpMtpzE
Threatray 192 similar samples on MalwareBazaar
TLSH D6A423359F976C80FAC9FA37A2B37C1D49D1D9A301DA8CB0D0D4BA68046A24759DBC3D
Reporter tildedennis
Tags:ZeuS zeus1


Avatar
tildedennis
zeus1 version 1.3.1.4

Intelligence

File Origin
# of uploads :
1
# of downloads :
1'524
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/37202/
Detection(s):
Win.Trojan.Zbot-4884
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a file in the Windows subdirectories
Enabling the 'hidden' option for recently created files
Sending a UDP request
Unauthorized injection to a system process
Enabling autorun
Result
Threat name:
Unknown
Detection:
malicious
Classification:
evad
Score:
80 / 100
Link:
https://www.joesandbox.com/analysis/407215
Signature
Allocates memory in foreign processes
Changes memory attributes in foreign processes to executable or writable
Contains functionality to change the desktop window for a process (likely to hide graphical interactions)
Creates an undocumented autostart registry key
Detected unpacking (changes PE section rights)
Injects a PE file into a foreign processes
Machine Learning detection for dropped file
Machine Learning detection for sample
Writes to foreign memory regions
Behaviour
Behavior Graph:
Download SVG
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/f46d61129fce27a1da5e4c47d3b7e515cb101878722f57f515df14b061e13af1/
Threat name:
Win32.Trojan.Zeus
Create hunting rule
Status:
Malicious
First seen:
2011-06-03 19:12:00 UTC
AV detection:
23 of 25 (92.00%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=6rwwceu7zyt2dws6jrd5hn7fcxfragdyoixvp5iv34klaypbhlyq._file
Verdict:
malicious
Similar samples:
2f2d9760aa86fa4b197c2dcbb361c85cbb63a40a8c7049a561fa720f67a9bb87
ZeuS
43b6dc747c6623e7dd015d1af51aadfb357815712960781342855291941ae0da
ZeuS
4549a428260ba0c60e1f59e1b30e5198df946baf93ecd037cf657c11d2d62dfd
ZeuS
93e7f4109711d62264dd5c292840556786b308a5014b9ef1691bbbabf4ed9aef
ZeuS
9c01cf666c922c17867f4d2a85d090376c6f82e2c77b16de330d116f147fca59
ZeuS
9eabb73fe305b3afaba2e0340c7e8cc8aa468769f9d55c3d967877596c856c3d
ZeuS
a1eb61bb63c4917ba4cea4d4be810cbae6395a75670b1b91d5e480d1bc6adae1
ZeuS
a32036a66a060f3592f621d1181683d2d07682815f43dbeffef771bb50776ee4
ZeuS
d99339360b38f6fd181678111f8a1b1ce54ca1c027c3fcf3ddb6ea28148e0088
ZeuS
ef82875918958a6a376fe6bf6562b136ebd61b816b34d4318b6aa4e150fa510c
ZeuS
+ 182 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  3/10
Tags:
n/a
Link:
https://tria.ge/reports/200802-mg76bmcmkj/
Behaviour
Suspicious use of WriteProcessMemory
Suspicious use of AdjustPrivilegeToken
Suspicious behavior: EnumeratesProcesses
Program crash
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Zbot
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/f46d61129fce27a1da5e4c47d3b7e515cb101878722f57f515df14b061e13af1

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:win_zeus_auto
Create hunting rule
Author:Felix Bilstein - yara-signator at cocacoding dot com
Description:autogenerated rule brought to you by yara-signator

File information

The table below shows additional information about this malware sample such as delivery method and external references.

  
Link
https://zeusmuseum.com/zeus1/
Cape
Cape
https://www.capesandbox.com/analysis/37202/

Comments