zharkbot | 4b5a876b1c230b28c0862d5f8158b3657016709855bf3329d8fea6cada3adbfe | Triage

Submit
Reports

Overview

overview

Static

static

7

b45668e08c...31.exe

windows7-x64

b45668e08c...31.exe

windows10-2004-x64

Sharing

General

Target

b45668e08c03024f2432ff332c319131.exe
Size

3.4MB
Sample

241103-hbbhqsxfrl
MD5

b45668e08c03024f2432ff332c319131
SHA1

4bef9109eaeace4107c47858eef2d9d3487e45f0
SHA256

4b5a876b1c230b28c0862d5f8158b3657016709855bf3329d8fea6cada3adbfe
SHA512

538c8471fc0313e68885d4d09140ec3e3374af3464af626195b6387a67b9bae9c3c9fd369d9dc7965decc182d13e8bbf95b4cf96b5ffc78af5d7904d59325bbc
SSDEEP

98304:MHKnK7qkC+8TMGHgWnvLBQ0YXpS3KZFc6LUARABDgAj:MqKYx9zu0YpSaZFcJA6BDga

Score

10^/10

zharkbot botnet discovery evasion themida trojan

Static task

static1

1 signatures

Behavioral task

behavioral1

Sample

b45668e08c03024f2432ff332c319131.exe

Resource

win7-20241010-en

zharkbot botnet discovery evasion themida trojan

windows7-x64

15 signatures

150 seconds

Behavioral task

behavioral2

Sample

b45668e08c03024f2432ff332c319131.exe

Resource

win10v2004-20241007-en

zharkbot botnet discovery evasion themida trojan

windows10-2004-x64

15 signatures

150 seconds

Malware Config

Targets

- Target
  
  b45668e08c03024f2432ff332c319131.exe
- Size
  
  3.4MB
- MD5
  
  b45668e08c03024f2432ff332c319131
- SHA1
  
  4bef9109eaeace4107c47858eef2d9d3487e45f0
- SHA256
  
  4b5a876b1c230b28c0862d5f8158b3657016709855bf3329d8fea6cada3adbfe
- SHA512
  
  538c8471fc0313e68885d4d09140ec3e3374af3464af626195b6387a67b9bae9c3c9fd369d9dc7965decc182d13e8bbf95b4cf96b5ffc78af5d7904d59325bbc
- SSDEEP
  
  98304:MHKnK7qkC+8TMGHgWnvLBQ0YXpS3KZFc6LUARABDgAj:MqKYx9zu0YpSaZFcJA6BDga
Score

10^/10

zharkbot botnet discovery evasion themida trojan
- Detects ZharkBot payload
  ZharkBot is a botnet written C++.
- ZharkBot
  ZharkBot is a botnet written C++.
  botnet zharkbot
- Zharkbot family
  zharkbot
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
  evasion
- Checks BIOS information in registry
  BIOS information is often read in order to detect sandboxing environments.
- Drops startup file
- Themida packer
  Detects Themida, an advanced Windows software protection system.
  themida
- Checks whether UAC is enabled
  evasion trojan
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

Credential Access

Discovery

Query Registry

System Information Discovery

System Location Discovery

System Language Discovery

Virtualization/Sandbox Evasion

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

zharkbotbotnetdiscoveryevasionthemidatrojan

behavioral2

zharkbotbotnetdiscoveryevasionthemidatrojan

© 2018-2024

Terms | Privacy