Behavioral task
behavioral1
Sample
d67a0d1d7b925591205bdb5c5b1da49724fd677722fcfaa4abd3cfc72fa09570.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
d67a0d1d7b925591205bdb5c5b1da49724fd677722fcfaa4abd3cfc72fa09570.exe
Resource
win10v2004-20220812-en
General
-
Target
d67a0d1d7b925591205bdb5c5b1da49724fd677722fcfaa4abd3cfc72fa09570
-
Size
3.6MB
-
MD5
64e2ebe9a5b76b5f0d922dc405e0f1ea
-
SHA1
7a6c872552d9d3ebcc02989e0ab379db981f0973
-
SHA256
d67a0d1d7b925591205bdb5c5b1da49724fd677722fcfaa4abd3cfc72fa09570
-
SHA512
aff30c79b12d92ff5c5114376092d32061e8d60c2f112fe1901a2220a4d7c80568b04aa07be6b855df726988a02a76dac68d1bfa71280964ac1f368933d89113
-
SSDEEP
49152:5gGh/J83H3LzrGpwt9aRuGPs+TqMpAwg7dfJ4b+ZwH2tL0/PrQD6oUlMXR:b83XLYw61Ps+BpAt7dhi+ZwH2tbXR
Malware Config
Extracted
zebrocy
http://89.37.226.148/technet-support/library/online-service-description.php?id_name=
Signatures
-
Zebrocy Go Variant 1 IoCs
resource yara_rule sample Zebrocy -
Zebrocy family
Files
-
d67a0d1d7b925591205bdb5c5b1da49724fd677722fcfaa4abd3cfc72fa09570.exe windows
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED
Sections
.text Size: 3.3MB - Virtual size: 3.3MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 285KB - Virtual size: 285KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: 882B - Virtual size: 882B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.symtab Size: 4B - Virtual size: 4B
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
.rsrc Size: 17KB - Virtual size: 17KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE