f7��w%���R7o���)Iؖ&���us��7��PШ�(c� ��0���R�Yw�[z��iKCCفqe���*�Q�u6�] vs���<�p�%5�ɑ��/���PI�F�v#�Z0���J7TZ^�+G�� �Y���Ӿ��Zxk�Ⱦv�\����ɵ���Z��fxY���p]7��}*����T6.Q9{$$0�h+�j44��&�S~zf ����աV�*!Y�eF��������C(j�g�c��s�_�Ͳ��ȼkj���G�V �44��U��Po�oEf�Eg�����������A�U]��+ӣD��6�}dH�ÚR-/xPn���_�8�慴�+�r��T��V�4$��g~����'^g3���^)֗*��+�͋5���0S[!p�s�@�������k2V�3>�$������㑚�0���7d&���;?���{�Q��j��βm�a�e���4&5�W�Nd�NY��tGu[���ST��Jd��X����H�,]c��m����>N�ܹo0�U!c�� Dt�G�[��;ޭ��q=,��X!Re�}N�|�,����宂Ŧ���v�ŧ5֤���!�(�����.VsI-�`�#>���FE�N�������e�v��4��^��_oQ�b�Z��"Af� 9!�BQ s��wt0�~O��D@>�T�ȉ/(��Ѧ��0��[�d#MǨ�O#Z�w����״���A�X��s��{=��@�e�p��؈X%Cy��L��&$�D�� j��ϰh�-Vq�����b��h(c2:)[M%qE�௪|�����BK��ܒ�v*(5I��6ܛ�P��v��2�v>[\�?�H�����BN���=e�2o���R�Q�[��/��� ���Ϩ�% ��hܦ�Ӹ�m.�;�AIph2"Ҩ���Gǥ�zyB������6_ L�TW�r��(i�7G��f��xt�T,�5N�TR�r���ӱa�۶Ϻz�s���Wz�����ϹA�m)����^��5�(��G�s�@b��lv�#��{N��~�9��<l���猏5���nMj�s��*O�\�<8Q�� �] n���Irx�T���۴�Iqo��*�*������I�0Co����#q3O��>�@�-�B�,�pQv��H~!��x�T�!n� "ع��֤��Z� ��A��� [J�? �8~X���2��]?N >Vr�d9�r��v�� �j��H�[Q��y��/�ljȓ�.u�j�qa��S�_>fP}�w�7���ڔ��J�o7��EV<�zR^azAy~ /�����_8@�̐��G��^��ݴ�Ԫ��X��4��r���O���W&4'� �v�)��u.+L5 8�mW��"%�g>9��Q.w�o�kz�!���ۛ��6����l[2�e]�4�so�o���RPb,�5n���̯䂵y�}��9|57��0�y��J�p�KZ�)�PV^�4����`Z�����/W)W���h��Pg�!�����R��v���R�s��5���rC%���+����ټ�l���`s�-�eY[�?=�̉���N�� ����אt��;VK�Yx#�\�-�ľt m��fS����'I��`q�c����I�S)۴bN���٦�,d��� ��$D�����3T��O��g6�Y���-����,OՂ�p��8Lb�L�j0�*�f��Q�f9cc*�3H�U�=(/a_�7���e�������RE����O�L� y�U��z�q�2'��U��#d��x��2Ca��S��/a�'[�ĆV��@e�>1���;��Q��Z���yI�w���TEe� <~��d\t�U�n�_mL������K��~����CY~�s(H q�!�,~���6�TQ��e�طO4�\�a\J�ӚWK�Z-hK�h��XF>��v:a@��yB���TzZ��o��?k{���j"�Nt��ak2vLь�j�4Ht�*���?��3��m��K�FD,o �����B���"�_ :�xZ�)Q�yu���/��b� +��$5�KN���12�~j`�D]o۸̦Rk1��AvIJ'a3"1���Q�7f�����$�������L(c^/"Q�˦N�����Δ��ş��/��]�Ef]�&�s~"~�FU���5�S��i]�e]�� R��Q0n릎�� ~j�A!��У�AGG��,��e0AH��Y'�i�8�n#�tM>_���T���U�[�<�&�=jޭ�e���Fuj5�2u�@j_e)��� �y���[���֘.�OgPd�!w�+��=|��k��� ���/�����G�{Ѻ��FM���a>�BنՒ����0��~�����R�O-t���O��+�:/ú�ye�����E���i.�Kӭj��!��g��Ӝ�^z�(�S������^���#�d��=7��f�4�A1�9y*�m� =�d`���Ɨ�h)JCΜ`����"��A1�*6�k zc �f�N�7j�!��i$�{�����Ǵ�E�To��ϣ;�E�QҘq��{[#��5�~`;�n5V]�q<Owj�����X��Qg����w�T����'��K���ė=�/��/�����ZW�U���;�9�ќ�<RyM��rK�b�-�#8�9j�u��SIWu��\-��t�����2���β�.��t�<����n�C;�� ��AJ�� �n�2�ddP,���@D�14^�A۪-�A�4��c9U@/L��h��Չ�H��OO�#fy0b����kA&6"��t�g�gB5))��`���h9��[�9bOMQ�|� �,l( �W%���ק]F<����<��j�+��_ڈ�3=�d\@��+�L̽��i�l����.C��*Y���- l&<�U��L�� ,�"�XS�������� ���ȏ��[����K"��"Ô�$g5/MzU�����ou|9{A�$Ԛu�� i |���>���.���Oj,�>n/'�k9k-��� � r�}�H� �r�G�������ཛྷ�#lrB�4��x2TC�hg��B����ԅ"NK��g�c�c,�zlm3�ų��;�d,��g�"***^�>t����u�'
Behavioral task
behavioral1
Sample
Zeus.dll
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
Zeus.dll
Resource
win10v2004-20240802-en
General
-
Target
Zeus.dll
-
Size
7.2MB
-
MD5
7543e0e3ce821f94e2c11fdd2b2a3916
-
SHA1
1586f32e0f0052895fc4958d3e6474b895df6fec
-
SHA256
74e34823cf8bad96ef69d6e3b31abfb4470179dc3d5935d6808432309f7106b0
-
SHA512
19e587c7cc26fbb8372891c132af39a782570d5ee88b7801643736f028654c2d2bfc01ce39fa9b20d6f0bc4da58a0d676c35e4feb724791e5ca078d00bb60de6
-
SSDEEP
196608:zaPq1skIa7zyOP68NWarZt0AFXPsAVqdW:Gy1aavyOP9N/rZ3HVW
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource Zeus.dll
Files
-
Zeus.dll.dll windows:6 windows x64 arch:x64
52acbe4dc92e520a57d389c546a9ceb2
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
Imports
d3d11
D3D11On12CreateDevice
d2d1
ord1
kernel32
GetLastError
FlsSetValue
LocalAlloc
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
FreeLibrary
LoadLibraryA
GetModuleHandleA
GetProcAddress
user32
ClientToScreen
GetProcessWindowStation
GetProcessWindowStation
GetUserObjectInformationW
ole32
CoCreateFreeThreadedMarshaler
msvcp140
??1?$basic_iostream@DU?$char_traits@D@std@@@std@@UEAA@XZ
wininet
HttpQueryInfoA
ws2_32
WSAStartup
imm32
ImmSetCandidateWindow
d3dcompiler_47
D3DCompile
bcrypt
BCryptOpenAlgorithmProvider
vcruntime140_1
__CxxFrameHandler4
vcruntime140
memset
api-ms-win-crt-heap-l1-1-0
_aligned_malloc
api-ms-win-crt-runtime-l1-1-0
_execute_onexit_table
api-ms-win-crt-string-l1-1-0
isalnum
api-ms-win-crt-time-l1-1-0
_localtime64
api-ms-win-crt-stdio-l1-1-0
fsetpos
api-ms-win-crt-convert-l1-1-0
strtof
api-ms-win-crt-math-l1-1-0
_dclass
api-ms-win-crt-filesystem-l1-1-0
_lock_file
api-ms-win-crt-locale-l1-1-0
localeconv
api-ms-win-crt-utility-l1-1-0
rand
api-ms-win-crt-environment-l1-1-0
getenv
oleaut32
GetErrorInfo
wtsapi32
WTSSendMessageW
Exports
Exports
Sections
.text Size: - Virtual size: 2.3MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 471KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 2.4MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: - Virtual size: 82KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
_RDATA Size: - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp0 Size: - Virtual size: 3.8MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.vmp1 Size: 7.2MB - Virtual size: 7.2MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 232B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 512B - Virtual size: 469B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ