Behavioral task
behavioral1
Sample
ZEUS SOFTAIM!/RUN AS ADMIN/tranquil_radiance.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
ZEUS SOFTAIM!/RUN AS ADMIN/tranquil_radiance.exe
Resource
win10v2004-20240802-en
General
-
Target
Unconfirmed3295.crdownload
-
Size
5.1MB
-
MD5
a39f3b3f4d79cf0bfd704a178329ef19
-
SHA1
019a9a660f4660a326318e6b1af26841eb8abad5
-
SHA256
3561150add9795fede47e5de54c63b1326b030e7b22609fd36ca30f8ba41ab67
-
SHA512
52325f243f81ec93b25ee70f85283ebffc7ad820aefdca65f315fbec2a131d82f829520e438911a311064f7cf919bb68bbea0b8d95c0357af403f6ae49159c61
-
SSDEEP
98304:Iqjk7le2Qz0AGxdwf+tfX+gRXeVSHG3jWB2PW0YnYx3v+PPGu1hrO29Hxy0:Iqjk0MxrfX+gpekSjWCt9q180
Malware Config
Signatures
-
resource yara_rule static1/unpack001/ZEUS SOFTAIM!/RUN AS ADMIN/tranquil_radiance.exe themida -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/ZEUS SOFTAIM!/RUN AS ADMIN/tranquil_radiance.exe
Files
-
Unconfirmed3295.crdownload.rar
-
ZEUS SOFTAIM!/RUN AS ADMIN/tranquil_radiance.exe.exe windows:6 windows x64 arch:x64
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Sections
Size: 411KB - Virtual size: 803KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Size: 433KB - Virtual size: 608KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Size: 27KB - Virtual size: 74KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 20KB - Virtual size: 34KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Size: 34KB - Virtual size: 116KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
.imports Size: 2KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: 512B - Virtual size: 4KB
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 117KB - Virtual size: 117KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.themida Size: - Virtual size: 7.4MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.boot Size: 4.2MB - Virtual size: 4.2MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.reloc Size: 16B - Virtual size: 4KB
IMAGE_SCN_MEM_READ