zharkbot | ac2d9e8d46142a58d9dd856162f40a882c84a9dafcb7b04552af1636437f4876[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
ac2d9e8d46142a58d9dd856162f40a882c84a9dafcb7b04552af1636437f4876.exe
Size 323KB
Sample240924-b4xs4swbpc
SHA256 ac2d9e8d46142a58d9dd856162f40a882c84a9dafcb7b04552af1636437f4876
MD5 ccfd1bde60f9fd68f290d106cd7edf1f
SHA1 816199ee85e50ed511b23654924b68272a8a98cf
SHA512 920436aab5a312b1f12725bd3071c769b80cd0e2ed3041a4f3e984d65ed8b8e096ea7b263450689078b89f0dcf1dc97903629c73b6ee02954e4d7595edd203aa
SSDEEP 6144:caQAJOmoNT1Q9ySJGgxl+scwYwpmlUzw0gNO9jnM6D13aJhHKLqkmL8llMqzJ4mD:caQAEpNT1Q9w5kmL8llhUs
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

zharkbot

Malware Config

Signatures

Detects ZharkBot payload 1 IoCs

ZharkBot is a botnet written C++.

resource	yara_rule
sample	zharkcore

Zharkbot family
zharkbot

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
ac2d9e8d46142a58d9dd856162f40a882c84a9dafcb7b04552af1636437f4876.exe

File Explorer

ac2d9e8d46142a58d9dd856162f40a882c84a9dafcb7b04552af1636437f4876.exe

.exe 323KB

ac2d9e8d46142a58d9dd856162f40a882c84a9dafcb7b04552af1636437f4876.exe

IMPHASH 86066554454deea625edb22af31c51bd
SHA256 ac2d9e8d46142a58d9dd856162f40a882c84a9dafcb7b04552af1636437f4876
MD5 ccfd1bde60f9fd68f290d106cd7edf1f
SHA1 816199ee85e50ed511b23654924b68272a8a98cf
SHA512 920436aab5a312b1f12725bd3071c769b80cd0e2ed3041a4f3e984d65ed8b8e096ea7b263450689078b89f0dcf1dc97903629c73b6ee02954e4d7595edd203aa
SSDEEP 6144:caQAJOmoNT1Q9ySJGgxl+scwYwpmlUzw0gNO9jnM6D13aJhHKLqkmL8llMqzJ4mD:caQAEpNT1Q9w5kmL8llhUs
MD5 SHA1 SHA512 SSDEEP

windows:6 windows x86 arch:x86

Detects ZharkBot payload

ZharkBot is a botnet written C++.
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

133499

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

ReadProcessMemory WriteProcessMemory GetModuleHandleA GetProcAddress Sleep VirtualProtectEx GetVersion GetComputerNameA WriteConsoleW HeapSize CreateFileW GetProcessHeap SetStdHandle VirtualAllocEx VirtualAlloc SetThreadContext GetThreadContext CreateProcessA ResumeThread K32GetModuleFileNameExA GetLastError K32EnumProcesses OpenProcess TerminateProcess GetCurrentProcessId CreateProcessW CloseHandle SetEnvironmentVariableW FreeEnvironmentStringsW GetEnvironmentStringsW GetOEMCP GetACP IsValidCodePage FindNextFileW FindFirstFileExW FindClose HeapReAlloc ReadConsoleW SetFilePointerEx GetFileSizeEx ReadFile GetConsoleMode GetConsoleOutputCP WideCharToMultiByte EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionEx DeleteCriticalSection EncodePointer DecodePointer MultiByteToWideChar LCMapStringEx CompareStringEx GetCPInfo GetStringTypeW IsProcessorFeaturePresent QueryPerformanceCounter GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead IsDebuggerPresent UnhandledExceptionFilter SetUnhandledExceptionFilter GetStartupInfoW GetModuleHandleW GetCurrentProcess RaiseException RtlUnwind SetLastError InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree FreeLibrary LoadLibraryExW ExitProcess GetModuleHandleExW GetStdHandle WriteFile GetModuleFileNameW GetCommandLineA GetCommandLineW HeapFree HeapAlloc CompareStringW LCMapStringW GetLocaleInfoW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW GetFileType FlushFileBuffers SetEndOfFile

advapi32

RegQueryValueExA RegOpenKeyExA RegCloseKey GetUserNameA

ole32

CoInitializeEx CoInitializeSecurity CoCreateInstance CoSetProxyBlanket CoUninitialize

oleaut32

SysAllocString SysFreeString VariantInit VariantClear

wininet

InternetOpenUrlA InternetOpenW InternetReadFile InternetCloseHandle