hxxps://zws[.]im/%F3%A0%81%AF%F3%A0%81%A7%F3%A0%81%AB%F3%A0%81%B4%F3%A0%81%B6%F3%A0%81%AD%F3%A0%81%A3 | Triage

Submit
Reports

Overview

overview

7

Static

static

1

URLScan

urlscan

1

https://zws.im/%F3%A...

windows7-x64

1

https://zws.im/%F3%A...

windows7-x64

1

https://zws.im/%F3%A...

windows10-1703-x64

4

https://zws.im/%F3%A...

windows10-2004-x64

1

https://zws.im/%F3%A...

windows11-21h2-x64

1

https://zws.im/%F3%A...

android-9-x86

7

https://zws.im/%F3%A...

android-10-x64

7

https://zws.im/%F3%A...

android-11-x64

7

https://zws.im/%F3%A...

android-13-x64

7

https://zws.im/%F3%A...

android-9-x86

7

https://zws.im/%F3%A...

macos-10.15-amd64

4

https://zws.im/%F3%A...

macos-10.15-amd64

4

https://zws.im/%F3%A...

debian-9-mipsel

https://zws.im/%F3%A...

debian-12-armhf

https://zws.im/%F3%A...

debian-12-mipsel

https://zws.im/%F3%A...

debian-9-mips

https://zws.im/%F3%A...

debian-9-mipsel

https://zws.im/%F3%A...

ubuntu-18.04-amd64

7

https://zws.im/%F3%A...

ubuntu-20.04-amd64

7

Resubmissions

18-04-2024 17:34

240418-v5f2jabf7x 6

18-04-2024 17:28

240418-v15jbsad94 7

Sharing

General

Target

https://zws.im/%F3%A0%81%AF%F3%A0%81%A7%F3%A0%81%AB%F3%A0%81%B4%F3%A0%81%B6%F3%A0%81%AD%F3%A0%81%A3
Sample

240418-v15jbsad94

Score

7^/10

android antivm collection discovery evasion linux macos spyware stealer

Static task

static1

URLScan task

urlscan1

Behavioral task

behavioral1

Sample

https://zws.im/%F3%A0%81%AF%F3%A0%81%A7%F3%A0%81%AB%F3%A0%81%B4%F3%A0%81%B6%F3%A0%81%AD%F3%A0%81%A3

Resource

win7-20240221-en

windows7-x64

4 signatures

600 seconds

Behavioral task

behavioral2

Sample

https://zws.im/%F3%A0%81%AF%F3%A0%81%A7%F3%A0%81%AB%F3%A0%81%B4%F3%A0%81%B6%F3%A0%81%AD%F3%A0%81%A3

Resource

win7-20240215-en

windows7-x64

4 signatures

600 seconds

Behavioral task

behavioral3

Sample

https://zws.im/%F3%A0%81%AF%F3%A0%81%A7%F3%A0%81%AB%F3%A0%81%B4%F3%A0%81%B6%F3%A0%81%AD%F3%A0%81%A3

Resource

win10-20240404-en

windows10-1703-x64

7 signatures

600 seconds

Behavioral task

behavioral4

Sample

https://zws.im/%F3%A0%81%AF%F3%A0%81%A7%F3%A0%81%AB%F3%A0%81%B4%F3%A0%81%B6%F3%A0%81%AD%F3%A0%81%A3

Resource

win10v2004-20240412-en

windows10-2004-x64

10 signatures

600 seconds

Behavioral task

behavioral5

Sample

https://zws.im/%F3%A0%81%AF%F3%A0%81%A7%F3%A0%81%AB%F3%A0%81%B4%F3%A0%81%B6%F3%A0%81%AD%F3%A0%81%A3

Resource

win11-20240412-en

windows11-21h2-x64

7 signatures

600 seconds

Behavioral task

behavioral6

Sample

https://zws.im/%F3%A0%81%AF%F3%A0%81%A7%F3%A0%81%AB%F3%A0%81%B4%F3%A0%81%B6%F3%A0%81%AD%F3%A0%81%A3

Resource

android-x86-arm-20240221-en

discovery evasion

android-9-x86

2 signatures

600 seconds

Behavioral task

behavioral7

Sample

https://zws.im/%F3%A0%81%AF%F3%A0%81%A7%F3%A0%81%AB%F3%A0%81%B4%F3%A0%81%B6%F3%A0%81%AD%F3%A0%81%A3

Resource

android-x64-20240221-en

collection discovery evasion

android-10-x64

3 signatures

600 seconds

Behavioral task

behavioral8

Sample

https://zws.im/%F3%A0%81%AF%F3%A0%81%A7%F3%A0%81%AB%F3%A0%81%B4%F3%A0%81%B6%F3%A0%81%AD%F3%A0%81%A3

Resource

android-x64-arm64-20240221-en

discovery evasion

android-11-x64

2 signatures

600 seconds

Behavioral task

behavioral9

Sample

https://zws.im/%F3%A0%81%AF%F3%A0%81%A7%F3%A0%81%AB%F3%A0%81%B4%F3%A0%81%B6%F3%A0%81%AD%F3%A0%81%A3

Resource

android-33-x64-arm64-20240229-en

discovery evasion

android-13-x64

2 signatures

600 seconds

Behavioral task

behavioral10

Sample

https://zws.im/%F3%A0%81%AF%F3%A0%81%A7%F3%A0%81%AB%F3%A0%81%B4%F3%A0%81%B6%F3%A0%81%AD%F3%A0%81%A3

Resource

android-x86-arm-20240221-en

discovery evasion

android-9-x86

2 signatures

600 seconds

Behavioral task

behavioral11

Sample

https://zws.im/%F3%A0%81%AF%F3%A0%81%A7%F3%A0%81%AB%F3%A0%81%B4%F3%A0%81%B6%F3%A0%81%AD%F3%A0%81%A3

Resource

macos-20240410-en

macos-10.15-amd64

1 signatures

600 seconds

Behavioral task

behavioral12

Sample

https://zws.im/%F3%A0%81%AF%F3%A0%81%A7%F3%A0%81%AB%F3%A0%81%B4%F3%A0%81%B6%F3%A0%81%AD%F3%A0%81%A3

Resource

macos-20240410-en

macos-10.15-amd64

1 signatures

600 seconds

Behavioral task

behavioral13

Sample

https://zws.im/%F3%A0%81%AF%F3%A0%81%A7%F3%A0%81%AB%F3%A0%81%B4%F3%A0%81%B6%F3%A0%81%AD%F3%A0%81%A3

Resource

debian9-mipsel-20240226-en

debian-9-mipsel

0 signatures

600 seconds

Behavioral task

behavioral14

Sample

https://zws.im/%F3%A0%81%AF%F3%A0%81%A7%F3%A0%81%AB%F3%A0%81%B4%F3%A0%81%B6%F3%A0%81%AD%F3%A0%81%A3

Resource

debian12-armhf-20240221-en

debian-12-armhf

0 signatures

600 seconds

Behavioral task

behavioral15

Sample

https://zws.im/%F3%A0%81%AF%F3%A0%81%A7%F3%A0%81%AB%F3%A0%81%B4%F3%A0%81%B6%F3%A0%81%AD%F3%A0%81%A3

Resource

debian12-mipsel-20240221-en

debian-12-mipsel

0 signatures

600 seconds

Behavioral task

behavioral16

Sample

https://zws.im/%F3%A0%81%AF%F3%A0%81%A7%F3%A0%81%AB%F3%A0%81%B4%F3%A0%81%B6%F3%A0%81%AD%F3%A0%81%A3

Resource

debian9-mipsbe-20240226-en

debian-9-mips

0 signatures

600 seconds

Behavioral task

behavioral17

Sample

https://zws.im/%F3%A0%81%AF%F3%A0%81%A7%F3%A0%81%AB%F3%A0%81%B4%F3%A0%81%B6%F3%A0%81%AD%F3%A0%81%A3

Resource

debian9-mipsel-20240226-en

debian-9-mipsel

0 signatures

600 seconds

Behavioral task

behavioral18

Sample

https://zws.im/%F3%A0%81%AF%F3%A0%81%A7%F3%A0%81%AB%F3%A0%81%B4%F3%A0%81%B6%F3%A0%81%AD%F3%A0%81%A3

Resource

ubuntu1804-amd64-20240226-en

antivm spyware stealer

ubuntu-18.04-amd64

7 signatures

600 seconds

Behavioral task

behavioral19

Sample

https://zws.im/%F3%A0%81%AF%F3%A0%81%A7%F3%A0%81%AB%F3%A0%81%B4%F3%A0%81%B6%F3%A0%81%AD%F3%A0%81%A3

Resource

ubuntu2004-amd64-20240221-en

antivm spyware stealer

ubuntu-20.04-amd64

8 signatures

600 seconds

Malware Config

Targets

- Target
  
  https://zws.im/%F3%A0%81%AF%F3%A0%81%A7%F3%A0%81%AB%F3%A0%81%B4%F3%A0%81%B6%F3%A0%81%AD%F3%A0%81%A3
Score

7^/10

discovery evasion antivm spyware stealer collection
- Changes its process name
- Checks CPU information
  Checks CPU information which indicate if the system is an emulator.
  evasion discovery
- Checks memory information
  Checks memory information which indicate if the system is an emulator.
  evasion discovery
- Reads the content of photos stored on the user's device.
  collection
- Reads user data of web browsers
  Reads stored browser data which can include saved credentials.
  spyware stealer
- Checks CPU configuration
  Checks CPU information which indicate if the system is a virtual machine.
  antivm
- Enumerates running processes
  Discovers information about currently running processes on the system
- Reads CPU attributes
behavioral1 behavioral10 behavioral11 behavioral12 behavioral13 behavioral14 behavioral15 behavioral16 behavioral17 behavioral18 behavioral19 behavioral2 behavioral3 behavioral4 behavioral5 behavioral6 behavioral7 behavioral8 behavioral9

MITRE ATT&CK Matrix

Tasks

static1

urlscan1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

discoveryevasion

behavioral7

collectiondiscoveryevasion

behavioral8

discoveryevasion

behavioral9

discoveryevasion

behavioral10

discoveryevasion

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

antivmspywarestealer

behavioral19

antivmspywarestealer

© 2018-2024

Terms | Privacy