zebrocy | c8317b86f43a189e92b66d45b0364c2c9d685a61e42fe51c0668e853a616f5b7

Sharing

Copy URL

Twitter E-mail

General

Target

c8317b86f43a189e92b66d45b0364c2c9d685a61e42fe51c0668e853a616f5b7
Size

4.2MB
MD5

d460d0131cf6ac28a69d783dc8217def
SHA1

36d74afea88a66ba7cbc568abc52337eaf082e6f
SHA256

c8317b86f43a189e92b66d45b0364c2c9d685a61e42fe51c0668e853a616f5b7
SHA512

569aba4fdc478ace75f71b79680857a760759767fda5a9ef53f257c3bdc7e2c3c881e8ec81aa27b49fa88d39ae70bd40b1b7d8846efb4871f013980b30ac219e

Score

10^/10

zebrocy

Malware Config

Signatures

Zebrocy Go Variant 1 IoCs

resource	yara_rule
sample	Zebrocy

Zebrocy family
zebrocy

Files

c8317b86f43a189e92b66d45b0364c2c9d685a61e42fe51c0668e853a616f5b7
.exe windows x86

20acdf581665d0a5acf497c2fe5e0662

Code Sign

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED

Imports

kernel32

AddVectoredExceptionHandler
CloseHandle
CreateEventA
CreateIoCompletionPort
CreateThread
DeleteCriticalSection
DuplicateHandle
EnterCriticalSection
ExitProcess
FreeEnvironmentStringsW
GetConsoleMode
GetEnvironmentStringsW
GetLastError
GetModuleHandleA
GetProcAddress
GetProcessAffinityMask
GetQueuedCompletionStatus
GetStdHandle
GetSystemInfo
InitializeCriticalSection
InterlockedDecrement
InterlockedExchangeAdd
InterlockedIncrement
LeaveCriticalSection
LoadLibraryA
LoadLibraryW
SetConsoleCtrlHandler
SetErrorMode
SetEvent
SetProcessPriorityBoost
SetUnhandledExceptionFilter
SetWaitableTimer
Sleep
SwitchToThread
TlsGetValue
VirtualAlloc
VirtualFree
VirtualProtect
VirtualQuery
WaitForSingleObject
WriteConsoleW
WriteFile

msvcrt

__getmainargs
__p__environ
__p__fmode
__set_app_type
_beginthread
_cexit
_errno
_iob
_onexit
_setmode
abort
atexit
calloc
fprintf
free
fwrite
malloc
memcpy
signal
vfprintf

winmm

timeBeginPeriod
timeEndPeriod

ws2_32

WSAGetOverlappedResult

Sections

.text
Size: 1.9MB - Virtual size: 1.9MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.gsyusp
Size: 191KB - Virtual size: 191KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 2.1MB - Virtual size: 2.1MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.eh_fram
Size: 1024B - Virtual size: 928B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.bss
Size: - Virtual size: 86KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.CRT
Size: 512B - Virtual size: 24B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tls
Size: 512B - Virtual size: 32B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 108KB - Virtual size: 108KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

20acdf581665d0a5acf497c2fe5e0662

Code Sign

Headers

File Characteristics

Imports

kernel32

msvcrt

winmm

ws2_32

Sections

.text Size: 1.9MB - Virtual size: 1.9MB

.gsyusp Size: 191KB - Virtual size: 191KB

.rdata Size: 2.1MB - Virtual size: 2.1MB

.eh_fram Size: 1024B - Virtual size: 928B

.bss Size: - Virtual size: 86KB

.idata Size: 2KB - Virtual size: 2KB

.CRT Size: 512B - Virtual size: 24B

.tls Size: 512B - Virtual size: 32B

.data Size: 108KB - Virtual size: 108KB

.text
Size: 1.9MB - Virtual size: 1.9MB

.gsyusp
Size: 191KB - Virtual size: 191KB

.rdata
Size: 2.1MB - Virtual size: 2.1MB

.eh_fram
Size: 1024B - Virtual size: 928B

.bss
Size: - Virtual size: 86KB

.idata
Size: 2KB - Virtual size: 2KB

.CRT
Size: 512B - Virtual size: 24B

.tls
Size: 512B - Virtual size: 32B

.data
Size: 108KB - Virtual size: 108KB