Overview

overview

7

Static

static

3

invoice_23...df.exe

windows10-2004-x64

7

Sharing

Copy URL
Twitter E-mail

General

  • Target

    ZeusBankingVersion_26Nov2013.zip

  • Size

    171KB

  • Sample

    231031-me6v9sfd21

  • MD5

    858e2aed6ba9b096679967da540d40c3

  • SHA1

    aaf400b8510beaae9f5c09b60c3e099ca1239f1c

  • SHA256

    4644b5fb10fb84c0d47bec4b5a48d5e60165e8ae2130fca5c055633aaad73162

  • SHA512

    95545f8c022a12bbfd6fa5db05319e015da529d90342918259176539163d4abeb2f4fd429e391ff37c37de5d654a1259199dc67e010caf2c3108b706c6548af5

  • SSDEEP

    3072:s2f7LeD2rcEE4U3FlrEKOAPoI5KUOqqJti2SAGBJMrUXz+qET12O:s+YqIDEKToI5x4i2Sdpz+/X

Score
7/10
persistence

Malware Config

Targets

    • Target

      invoice_2318362983713_823931342io.pdf.exe

    • Size

      247KB

    • MD5

      ea039a854d20d7734c5add48f1a51c34

    • SHA1

      9615dca4c0e46b8a39de5428af7db060399230b2

    • SHA256

      69e966e730557fde8fd84317cdef1ece00a8bb3470c0b58f3231e170168af169

    • SHA512

      6718e54a59b91537c41ac913f9d8d6ad97b08cf6a61a4d174458738579a33471ef357173fd9eb4d4c9652ed2bf86c41f6da3cdd20fd7af643cd9f5ee6c9e30d5

    • SSDEEP

      6144:Tz/LBBTHT+7oEf2ZstxQMSGToLoOhD2saLsW8fsmFBkObjD:PLBdy7FpQMlToThD+sW8fsmP7bj

    Score
    7/10
    persistence

    • Deletes itself

    • Unexpected DNS network traffic destination

      Network traffic to other servers than the configured DNS servers was detected on the DNS port.

    • Adds Run key to start application

      persistence

    • Suspicious use of SetThreadContext

    behavioral1

MITRE ATT&CK Enterprise v15

Tasks