Overview

overview

10

Static

static

1

cyewa.ps1

windows7-x64

3

cyewa.ps1

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    cyewa.ps1

  • Size

    1.2MB

  • Sample

    240923-slh1nszbnj

  • MD5

    8481d9764cda27d097559253f6c5804a

  • SHA1

    813e576e5f5ee54ee74ead61e30b6e3d04a377a3

  • SHA256

    3d641dae182ce73851fcfb842ba19ba70f0e5c2b02730fc66948cec688d3949d

  • SHA512

    3a0b4eb5fd1e01656256308c40e5eca3eb036e33fe686ce22dc6223b2057359db0da020aab8d80c1c68f0b60b17565bf37c60e76224b4fecb5c320c52d9cd282

  • SSDEEP

    12288:l1zabLuoWRUFTNEbBgBLriOlZX9bfWizIq7Q6QXRfThcjLIq20nDcsOSv3UZ5lTC:uV7TOZG

Score
10/10
zharkbotbotnetdiscoveryexecution

Malware Config

Targets

    • Target

      cyewa.ps1

    • Size

      1.2MB

    • MD5

      8481d9764cda27d097559253f6c5804a

    • SHA1

      813e576e5f5ee54ee74ead61e30b6e3d04a377a3

    • SHA256

      3d641dae182ce73851fcfb842ba19ba70f0e5c2b02730fc66948cec688d3949d

    • SHA512

      3a0b4eb5fd1e01656256308c40e5eca3eb036e33fe686ce22dc6223b2057359db0da020aab8d80c1c68f0b60b17565bf37c60e76224b4fecb5c320c52d9cd282

    • SSDEEP

      12288:l1zabLuoWRUFTNEbBgBLriOlZX9bfWizIq7Q6QXRfThcjLIq20nDcsOSv3UZ5lTC:uV7TOZG

    Score
    10/10
    executionzharkbotbotnetdiscovery

    • Detects ZharkBot payload

      ZharkBot is a botnet written C++.

    • ZharkBot

      ZharkBot is a botnet written C++.

      botnetzharkbot

    • Blocklisted process makes network request

    • Legitimate hosting services abused for malware hosting/C2

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks