zharkbot | 24a3061eaa4ced106c15b1aea8bd14a5cd17750c6241b2ed4ab6548843e44e90

Sharing

Copy URL Twitter E-mail

General

Target
24a3061eaa4ced106c15b1aea8bd14a5cd17750c6241b2ed4ab6548843e44e90
Size 325KB
Sample250709-c2eeeszxbv
SHA256 24a3061eaa4ced106c15b1aea8bd14a5cd17750c6241b2ed4ab6548843e44e90
MD5 4dbb6133449b3ce0570b126c8b8dbe31
SHA1 9ad0d461440eab9d99f23c3564b12d178ead5f32
SHA512 e451aeba42d46a7f250c78ff829ced9169b955ed64a9d066be7e3ac5d6c0750a1dc8ded7a565731d39d224251ae20fff09fa44052083b4fb551b1b6167e8cc58
SSDEEP 6144:3a/89wJKJV4+MbF9QqHN0y2nTnWKg45n/K0iG4O2ydN4wwfSFKVTw7n5kIZ9Iuju:3a/8y0n4+MLfOKVTwLTiKP2
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

zharkbot

Malware Config

Signatures

Detects ZharkBot payload 1 IoCs

ZharkBot is a botnet written C++.

resource	yara_rule
sample	zharkcore

Zharkbot family
zharkbot

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
24a3061eaa4ced106c15b1aea8bd14a5cd17750c6241b2ed4ab6548843e44e90

File Explorer

24a3061eaa4ced106c15b1aea8bd14a5cd17750c6241b2ed4ab6548843e44e90

.exe 325KB

24a3061eaa4ced106c15b1aea8bd14a5cd17750c6241b2ed4ab6548843e44e90

IMPHASH 86066554454deea625edb22af31c51bd
SHA256 24a3061eaa4ced106c15b1aea8bd14a5cd17750c6241b2ed4ab6548843e44e90
MD5 4dbb6133449b3ce0570b126c8b8dbe31
SHA1 9ad0d461440eab9d99f23c3564b12d178ead5f32
SHA512 e451aeba42d46a7f250c78ff829ced9169b955ed64a9d066be7e3ac5d6c0750a1dc8ded7a565731d39d224251ae20fff09fa44052083b4fb551b1b6167e8cc58
SSDEEP 6144:3a/89wJKJV4+MbF9QqHN0y2nTnWKg45n/K0iG4O2ydN4wwfSFKVTw7n5kIZ9Iuju:3a/8y0n4+MLfOKVTwLTiKP2
MD5 SHA1 SHA512 SSDEEP

windows:6 windows x86 arch:x86

Detects ZharkBot payload

ZharkBot is a botnet written C++.
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

133979

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

ReadProcessMemory WriteProcessMemory GetModuleHandleA GetProcAddress Sleep VirtualProtectEx GetVersion GetComputerNameA WriteConsoleW HeapSize CreateFileW GetProcessHeap SetStdHandle VirtualAllocEx VirtualAlloc SetThreadContext GetThreadContext CreateProcessA ResumeThread K32GetModuleFileNameExA GetLastError K32EnumProcesses OpenProcess TerminateProcess GetCurrentProcessId CreateProcessW CloseHandle SetEnvironmentVariableW FreeEnvironmentStringsW GetEnvironmentStringsW GetOEMCP GetACP IsValidCodePage FindNextFileW FindFirstFileExW FindClose HeapReAlloc ReadConsoleW SetFilePointerEx GetFileSizeEx ReadFile GetConsoleMode GetConsoleOutputCP WideCharToMultiByte EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionEx DeleteCriticalSection EncodePointer DecodePointer MultiByteToWideChar LCMapStringEx CompareStringEx GetCPInfo GetStringTypeW IsProcessorFeaturePresent QueryPerformanceCounter GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead IsDebuggerPresent UnhandledExceptionFilter SetUnhandledExceptionFilter GetStartupInfoW GetModuleHandleW GetCurrentProcess RaiseException RtlUnwind SetLastError InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree FreeLibrary LoadLibraryExW ExitProcess GetModuleHandleExW GetStdHandle WriteFile GetModuleFileNameW GetCommandLineA GetCommandLineW HeapFree HeapAlloc CompareStringW LCMapStringW GetLocaleInfoW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW GetFileType FlushFileBuffers SetEndOfFile

advapi32

RegQueryValueExA RegOpenKeyExA RegCloseKey GetUserNameA

ole32

CoInitializeEx CoInitializeSecurity CoCreateInstance CoSetProxyBlanket CoUninitialize

oleaut32

SysAllocString SysFreeString VariantInit VariantClear

wininet

InternetOpenUrlA InternetOpenW InternetReadFile InternetCloseHandle