Overview

overview

10

Static

static

1

3d641dae18...9d.ps1

windows7-x64

3

3d641dae18...9d.ps1

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    d724c5f3cc45e4dc20aa136f945866f8e3d3ff7733c063a2cd73fca1080ec879.zip

  • Size

    269KB

  • Sample

    240924-b8mtpsscqj

  • MD5

    78eecc307acff61b921890baf046cdbf

  • SHA1

    d8ec8a4d04a1fbb8146ec5d997ac6229561e4a81

  • SHA256

    d724c5f3cc45e4dc20aa136f945866f8e3d3ff7733c063a2cd73fca1080ec879

  • SHA512

    12edbc4d387c782f2147d92545a791ddedd599eb1002f6e3ff2a0b8dd5f2d03a7d867276f20a23517eec4bb7f13fa2e2262327aa95806d164ac8ea8e5a559589

  • SSDEEP

    6144:0tdGH54LhtA7Z6fEsnrYw5w+4GdjMplj73GC7BHaqP7gyBH:QGH5ooiEJYTgGC9fBH

Score
10/10
zharkbotbotnetdiscoveryexecution

Malware Config

Targets

    • Target

      3d641dae182ce73851fcfb842ba19ba70f0e5c2b02730fc66948cec688d3949d.ps1

    • Size

      1.2MB

    • MD5

      8481d9764cda27d097559253f6c5804a

    • SHA1

      813e576e5f5ee54ee74ead61e30b6e3d04a377a3

    • SHA256

      3d641dae182ce73851fcfb842ba19ba70f0e5c2b02730fc66948cec688d3949d

    • SHA512

      3a0b4eb5fd1e01656256308c40e5eca3eb036e33fe686ce22dc6223b2057359db0da020aab8d80c1c68f0b60b17565bf37c60e76224b4fecb5c320c52d9cd282

    • SSDEEP

      12288:l1zabLuoWRUFTNEbBgBLriOlZX9bfWizIq7Q6QXRfThcjLIq20nDcsOSv3UZ5lTC:uV7TOZG

    Score
    10/10
    executionzharkbotbotnetdiscovery

    • Detects ZharkBot payload

      ZharkBot is a botnet written C++.

    • ZharkBot

      ZharkBot is a botnet written C++.

      botnetzharkbot

    • Blocklisted process makes network request

    • Legitimate hosting services abused for malware hosting/C2

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks