zharkbot | 07e2b9eb074f2dcea1fd04319e6e3044642d1aa3580366afbc45bab995006687[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
07e2b9eb074f2dcea1fd04319e6e3044642d1aa3580366afbc45bab995006687.exe
Size 326KB
Sample240920-behynazhqf
SHA256 07e2b9eb074f2dcea1fd04319e6e3044642d1aa3580366afbc45bab995006687
MD5 9545b58dc0f94aca056b88a0df4456ec
SHA1 b57ec127c8ffef434f2eefbc534549273a440f07
SHA512 004a65617a5675f58b12bbd832de6cc0815cbbd65b89e3a224854f42ab01bda4fb11ff4ba2ecdcab0bfff4c3b5fdc07be813119aa9aa36870872e60128090a2e
SSDEEP 6144:hMg+6DK0H/jlibxf4wk2wgzmtmOgNLzmRPbzob6oyLNrdgA9trpWbzTbsmWILv+f:hMg+M5H7libf4trpWbq26
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

zharkbot

Malware Config

Signatures

Detects ZharkBot payload 1 IoCs

ZharkBot is a botnet written C++.

resource	yara_rule
sample	zharkcore

Zharkbot family
zharkbot

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
07e2b9eb074f2dcea1fd04319e6e3044642d1aa3580366afbc45bab995006687.exe

File Explorer

07e2b9eb074f2dcea1fd04319e6e3044642d1aa3580366afbc45bab995006687.exe

.exe 326KB

07e2b9eb074f2dcea1fd04319e6e3044642d1aa3580366afbc45bab995006687.exe

IMPHASH 86066554454deea625edb22af31c51bd
SHA256 07e2b9eb074f2dcea1fd04319e6e3044642d1aa3580366afbc45bab995006687
MD5 9545b58dc0f94aca056b88a0df4456ec
SHA1 b57ec127c8ffef434f2eefbc534549273a440f07
SHA512 004a65617a5675f58b12bbd832de6cc0815cbbd65b89e3a224854f42ab01bda4fb11ff4ba2ecdcab0bfff4c3b5fdc07be813119aa9aa36870872e60128090a2e
SSDEEP 6144:hMg+6DK0H/jlibxf4wk2wgzmtmOgNLzmRPbzob6oyLNrdgA9trpWbzTbsmWILv+f:hMg+M5H7libf4trpWbq26
MD5 SHA1 SHA512 SSDEEP

windows:6 windows x86 arch:x86

Detects ZharkBot payload

ZharkBot is a botnet written C++.
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

136459

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

ReadProcessMemory WriteProcessMemory GetModuleHandleA GetProcAddress Sleep VirtualProtectEx GetVersion GetComputerNameA WriteConsoleW HeapSize CreateFileW GetProcessHeap SetStdHandle VirtualAllocEx VirtualAlloc SetThreadContext GetThreadContext CreateProcessA ResumeThread K32GetModuleFileNameExA GetLastError K32EnumProcesses OpenProcess TerminateProcess GetCurrentProcessId CreateProcessW CloseHandle SetEnvironmentVariableW FreeEnvironmentStringsW GetEnvironmentStringsW GetOEMCP GetACP IsValidCodePage FindNextFileW FindFirstFileExW FindClose HeapReAlloc ReadConsoleW SetFilePointerEx GetFileSizeEx ReadFile GetConsoleMode GetConsoleOutputCP WideCharToMultiByte EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionEx DeleteCriticalSection EncodePointer DecodePointer MultiByteToWideChar LCMapStringEx CompareStringEx GetCPInfo GetStringTypeW IsProcessorFeaturePresent QueryPerformanceCounter GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead IsDebuggerPresent UnhandledExceptionFilter SetUnhandledExceptionFilter GetStartupInfoW GetModuleHandleW GetCurrentProcess RaiseException RtlUnwind SetLastError InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree FreeLibrary LoadLibraryExW ExitProcess GetModuleHandleExW GetStdHandle WriteFile GetModuleFileNameW GetCommandLineA GetCommandLineW HeapFree HeapAlloc CompareStringW LCMapStringW GetLocaleInfoW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW GetFileType FlushFileBuffers SetEndOfFile

advapi32

RegQueryValueExA RegOpenKeyExA RegCloseKey GetUserNameA

ole32

CoInitializeEx CoInitializeSecurity CoCreateInstance CoSetProxyBlanket CoUninitialize

oleaut32

SysAllocString SysFreeString VariantInit VariantClear

wininet

InternetOpenUrlA InternetOpenW InternetReadFile InternetCloseHandle