zharkbot | 4c26dd1754f1bd8da1c39bc2c7721d5bccbd6403d56f0370c53ee4d518167874 | Triage

Submit
Reports

Overview

overview

Static

static

3

cryptolaemus

windows10-2004-x64

cryptolaemus

windows11-21h2-x64

Sharing

General

Target

4c26dd1754f1bd8da1c39bc2c7721d5bccbd6403d56f0370c53ee4d518167874
Size

1.2MB
Sample

240915-1yccnavgrp
MD5

43044a8822f069feddd9c02fe36d8517
SHA1

7ed988939944d311a580e145198a6b4cc5741355
SHA256

4c26dd1754f1bd8da1c39bc2c7721d5bccbd6403d56f0370c53ee4d518167874
SHA512

fb7f178877f94e7132508d1475dfdadbd2b71f4d8b3c779e509829fd2ea4d223328a389c6521729616cd15900d72b57a3fe0f0b6502c9bba7c60194c65d66f4b
SSDEEP

24576:v9tuVdYYq6r4KmT/VKl/kb9sY5uJ1VMa6z3ZD+yA5HQMh4/Vp58t2Wcd:vD+Js9C0udwtzJKyA5HQcKUzy

Score

10^/10

zharkbot botnet discovery

Static task

static1

1 signatures

Behavioral task

behavioral1

Sample

4c26dd1754f1bd8da1c39bc2c7721d5bccbd6403d56f0370c53ee4d518167874.exe

Resource

win10v2004-20240802-en

zharkbot botnet discovery

windows10-2004-x64

16 signatures

150 seconds

Behavioral task

behavioral2

Sample

4c26dd1754f1bd8da1c39bc2c7721d5bccbd6403d56f0370c53ee4d518167874.exe

Resource

win11-20240802-en

zharkbot botnet discovery

windows11-21h2-x64

15 signatures

150 seconds

Malware Config

Targets

- Target
  
  4c26dd1754f1bd8da1c39bc2c7721d5bccbd6403d56f0370c53ee4d518167874
- Size
  
  1.2MB
- MD5
  
  43044a8822f069feddd9c02fe36d8517
- SHA1
  
  7ed988939944d311a580e145198a6b4cc5741355
- SHA256
  
  4c26dd1754f1bd8da1c39bc2c7721d5bccbd6403d56f0370c53ee4d518167874
- SHA512
  
  fb7f178877f94e7132508d1475dfdadbd2b71f4d8b3c779e509829fd2ea4d223328a389c6521729616cd15900d72b57a3fe0f0b6502c9bba7c60194c65d66f4b
- SSDEEP
  
  24576:v9tuVdYYq6r4KmT/VKl/kb9sY5uJ1VMa6z3ZD+yA5HQMh4/Vp58t2Wcd:vD+Js9C0udwtzJKyA5HQcKUzy
Score

10^/10

zharkbot botnet discovery
- Detects ZharkBot payload
  ZharkBot is a botnet written C++.
- Suspicious use of NtCreateUserProcessOtherParentProcess
- ZharkBot
  ZharkBot is a botnet written C++.
  botnet zharkbot
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Drops startup file
- Executes dropped EXE
- Enumerates processes with tasklist
  discovery
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

Scheduled Task

Persistence

Scheduled Task/Job

Scheduled Task

Privilege Escalation

Scheduled Task/Job

Scheduled Task

Defense Evasion

Credential Access

Discovery

Process Discovery

Query Registry

System Information Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

zharkbotbotnetdiscovery

behavioral2

zharkbotbotnetdiscovery

© 2018-2024

Terms | Privacy