zharkbot | 3663c34a774b45d65edb817e27dcbdae[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
3663c34a774b45d65edb817e27dcbdae.exe
Size 326KB
Sample241007-3vlg9ssfpg
SHA256 f203e00cfa3c0ff98670d56ace48c0ee7bf1a997309a8da1379d5291cbe37c3d
MD5 3663c34a774b45d65edb817e27dcbdae
SHA1 4e9333fbdc6540bc312f6b324df9eb7dafedde2e
SHA512 88c4939f5c2613e7fa62040d3307f9fc0c2f2e0bae4c7c166d5fb6ee6b921c99636dc89935b31c60d4ba45afd5ebdd80ba51914cb37e9e2a604781de89e45c05
SSDEEP 6144:Uypo5x1dkBovN2s0GGDwmW9pLbLGou5YLQRjpj3xm3Z9F+MEuMBoSVGLJnt2QE92:Uypo5eBovNguMGSVGLM7uXjazj6AE+W
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

zharkbot

Malware Config

Signatures

Detects ZharkBot payload 1 IoCs

ZharkBot is a botnet written C++.

resource	yara_rule
sample	zharkcore

Zharkbot family
zharkbot

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
3663c34a774b45d65edb817e27dcbdae.exe

File Explorer

3663c34a774b45d65edb817e27dcbdae.exe

.exe 326KB

3663c34a774b45d65edb817e27dcbdae.exe

IMPHASH 86066554454deea625edb22af31c51bd
SHA256 f203e00cfa3c0ff98670d56ace48c0ee7bf1a997309a8da1379d5291cbe37c3d
MD5 3663c34a774b45d65edb817e27dcbdae
SHA1 4e9333fbdc6540bc312f6b324df9eb7dafedde2e
SHA512 88c4939f5c2613e7fa62040d3307f9fc0c2f2e0bae4c7c166d5fb6ee6b921c99636dc89935b31c60d4ba45afd5ebdd80ba51914cb37e9e2a604781de89e45c05
SSDEEP 6144:Uypo5x1dkBovN2s0GGDwmW9pLbLGou5YLQRjpj3xm3Z9F+MEuMBoSVGLJnt2QE92:Uypo5eBovNguMGSVGLM7uXjazj6AE+W
MD5 SHA1 SHA512 SSDEEP

windows:6 windows x86 arch:x86

Detects ZharkBot payload

ZharkBot is a botnet written C++.
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

135515

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

ReadProcessMemory WriteProcessMemory GetModuleHandleA GetProcAddress Sleep VirtualProtectEx GetVersion GetComputerNameA WriteConsoleW HeapSize CreateFileW GetProcessHeap SetStdHandle VirtualAllocEx VirtualAlloc SetThreadContext GetThreadContext CreateProcessA ResumeThread K32GetModuleFileNameExA GetLastError K32EnumProcesses OpenProcess TerminateProcess GetCurrentProcessId CreateProcessW CloseHandle SetEnvironmentVariableW FreeEnvironmentStringsW GetEnvironmentStringsW GetOEMCP GetACP IsValidCodePage FindNextFileW FindFirstFileExW FindClose HeapReAlloc ReadConsoleW SetFilePointerEx GetFileSizeEx ReadFile GetConsoleMode GetConsoleOutputCP WideCharToMultiByte EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionEx DeleteCriticalSection EncodePointer DecodePointer MultiByteToWideChar LCMapStringEx CompareStringEx GetCPInfo GetStringTypeW IsProcessorFeaturePresent QueryPerformanceCounter GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead IsDebuggerPresent UnhandledExceptionFilter SetUnhandledExceptionFilter GetStartupInfoW GetModuleHandleW GetCurrentProcess RaiseException RtlUnwind SetLastError InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree FreeLibrary LoadLibraryExW ExitProcess GetModuleHandleExW GetStdHandle WriteFile GetModuleFileNameW GetCommandLineA GetCommandLineW HeapFree HeapAlloc CompareStringW LCMapStringW GetLocaleInfoW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW GetFileType FlushFileBuffers SetEndOfFile

advapi32

RegQueryValueExA RegOpenKeyExA RegCloseKey GetUserNameA

ole32

CoInitializeEx CoInitializeSecurity CoCreateInstance CoSetProxyBlanket CoUninitialize

oleaut32

SysAllocString SysFreeString VariantInit VariantClear

wininet

InternetOpenUrlA InternetOpenW InternetReadFile InternetCloseHandle