aa2f392fb1a2c6b007d6c0e4ca676ba56a6c8d54c74bb65b1fe0d0e811bb0988

Sharing

Copy URL Twitter E-mail

General

Target
ZeuS 2.0.8.9.zip
Size 8.9MB
Sample260727-gn5rnswelb
SHA256 aa2f392fb1a2c6b007d6c0e4ca676ba56a6c8d54c74bb65b1fe0d0e811bb0988
MD5 7e51a17864cd0eca6f23b1857d1f258e
SHA1 cd79fedcc22dc1146fcf2465dc33c83f58e550dc
SHA512 9a57721937967c33211ff0c007e83f80eb4c5750542a0b08507f446fb7556af62b233260783ef87de7bb882cba89b82c4c9e23ddd802504941482fa42de516ff
SSDEEP 196608:d/VjEFpLcSybICriuM9QtBmTJOYif46ncPOl0elA2NVlnihJPeZ4fVu:d/ZswbHij90sM3f4mkWzAslnihJPffVu
TLSH
T122963366C1B61268D00BBA3C87CC1980D7B96B796B6BE4079C4C060E5ED82DF76E5F4C
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

Malware Config

Targets

- Target
  ZeuS 2.0.8.9/make.cmd
- Size 74B
- SHA256 b98fc83e93a03f1199eae4c0dee6bae355e162a391c900d901b8c13404478226
- MD5 c258d56294da636b17fe2159db5e25e6
- SHA1 7386f827f7f39986ff81421d9230cc4af8b4b278
- SHA512 af51f5c5a607617eae1bb27206a973529e6442184f4c4609d121b11e292412833b47e8a86a547aefa46e616847271fa3bb7c936093db45d53f99105c8961a372
- TLSH
  T1A2A022C3C0E0E0F0C08A0C000A032003F30F2002082FB030B0CC00B8AF20328E80BC33
- MD5 SHA1 SHA512 TLSH
Score

3^/10

discovery execution
behavioral1 behavioral2
- Target
  ZeuS 2.0.8.9/make/tools.inc.php
- Size 26KB
- SHA256 f30fd4b89fe6dad99c2783bd238f61fff180e85e6293419b55dfe67a9506bc36
- MD5 6eaf7b80997a9e77d01fc6834660cd0a
- SHA1 8d3d45bf979ed1deaa21c1a7efcb3a1d701e8862
- SHA512 9d1d98c9b7303906f56343dfa6071494fe7396ba692c57b78a4cd16826ad9102fa57996c83be930e4bd1f4ea9e048d94a5ac9a316da8ef13680deae6568d9fc1
- SSDEEP 384:BsPYDBBubn5AjJ2JiJVyWGGImxYsalf/UzPdgZUBXnXNwdEZpcchemrrxL:BBBu+RKWdxriUzPdqu+E7NzHZ
- TLSH
  T113C2C7947846943152F34B2F8B97C52CDDF3662B8910BB61FAAC34C51F3015899FDE89
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral3 behavioral4
- Target
  ZeuS 2.0.8.9/make_debug.cmd
- Size 78B
- SHA256 80b4c362bf1c3892f0266a4f2a90377fbb4fdd18f70f9d844af8449daef3e7d4
- MD5 a5ae79527637855fc1bc721fb46b3c2f
- SHA1 44b2734d21bbfa6cdd3af96f1635e7961a576caa
- SHA512 5dea6769d3170dc070983326d254fa92a8e04853320b31ada3a24bd736e1a7d0cf4968060f79a4726b2ccab19fd0cfb4742a29159053dc872276466deec496dd
- TLSH
  T17CA0118200A2A0B0AB8A0C0388022203A32320830828A2A0A0CC02A8AF20008880BC2A
- MD5 SHA1 SHA512 TLSH
Score

3^/10

discovery execution
behavioral5 behavioral6
- Target
  ZeuS 2.0.8.9/make_default.cmd
- Size 82B
- SHA256 ac888dae42eac0e406a1aae6bd8f0070a95b9d5efcf394be2c836238a9cd2633
- MD5 15b8dfc04197c97d08c4f4dfa31e55ab
- SHA1 4b313b819fb0c91037d51a2eb739370772a05bd8
- SHA512 223d87175fcf26dac73819a3d3ebf85aa118af82bbc34c4facc0d23cdb92872008aadc8105a5d49c9b64796db7c19a6e21926d9fe97bfa67ef6d876c0aa82d0a
- TLSH
  T1F8A022C2A0E0C0B2E28E0C000C023803F3032802282EB03CF0CC00F8BF28208A8CBEB3
- MD5 SHA1 SHA512 TLSH
Score

3^/10

discovery execution
behavioral7 behavioral8
- Target
  ZeuS 2.0.8.9/make_full.cmd
- Size 97B
- SHA256 6f1e06f7800cd6e6d15cc7af789eca65d6cef9a5df20ffa8e0313f0501211fbf
- MD5 9db22d478d93eeb024d9134d5902ec41
- SHA1 62e66eea627d08c0079b56ae4d37ea69f7f876be
- SHA512 ef73d63e63a7b6e7cb1ab3f6a5b6130cd7a8e9a2ae8979676c6a1bbeaeb50d2b7378d7073f92e56be6fc9d7385db12796754aa2e2870961d5be0386b2b6b4f8e
- TLSH
  T1A6B012A7809080B1C08E0C0158061A83F3A31001141EF424E0E980B47F30314544BCA2
- MD5 SHA1 SHA512 TLSH
Score

3^/10

discovery execution
behavioral10 behavioral9
- Target
  ZeuS 2.0.8.9/manual_en.html
- Size 44KB
- SHA256 1ce4a5ccf40a5ee5c87d4f98be228244ef451d82ec26107acff0c92fdadbedfb
- MD5 3e31acd79d12ab1969a29568e23edf78
- SHA1 41ed39f2fffd7e9bdb6df7169a9600d41b151bc4
- SHA512 5bc49a384ab5360c4566e03e8eabf67173e5e2dbbcc1d04f827d48c1318cf7282631bcce44c95d7e70bce3f64e1bd836bed32c17d6b80b620c389b8e3c399167
- SSDEEP 768:S77ckixhvdvGGbwEecW7OUqeILkSgSek+B4FdZKN+6CsrDW4K6MkMeimSe5:S77cVh8mecK/qeiGRSTMWn6MkMeimSe5
- TLSH
  T16B23952347C0733301B202457F1D77D4EF65806BB3164AA234AF856F6FB99649AB35CA
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral11 behavioral12
- Target
  ZeuS 2.0.8.9/manual_ru.html
- Size 45KB
- SHA256 c7f96e757deb8a37db8acde69ce6d12ef461e13dad9baad76f93d614d0efd344
- MD5 ae3eb511467164a82d3b78ef0be586f7
- SHA1 9422d400e505d8293583df891b15ac391cecb55e
- SHA512 6cfe33e6ed97352cf2218d2ea77e3496ed24299d12fb91b2e26fb426065f663838295b85e195c394508e949046c97909d1c348115050097cf22db2c6a05672e5
- SSDEEP 768:SCx+2Ar0BdMWMgsuO9gcnN7eMMMeEMqK7G2LrdDL:STa9Wh7ezMeBqKS2tv
- TLSH
  T13E2393B387C0F9120230096C7E166B10DCD58953E20A6FE2B49F985FAFB65429C67E4B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral13 behavioral14
- Target
  ZeuS 2.0.8.9/output/builder/webinjects.txt
- Size 69KB
- SHA256 234d7d11a0b0bc12e6bd6762411d27e19889d6fccaa7d7a4258a11e7331c1f4f
- MD5 798f654ef8af8db3c44355d4bfda9ee4
- SHA1 4eba8f81cd43cec138575e357d166e14bbafbce0
- SHA512 1cf09220345ccea9180500f1e4cbeae3712c9cc02f40198d58701c8072a90eb17583ef0ea1105ffdcfcc4e109d182c8545daa4a51b533f705c8df45136fcd927
- SSDEEP 384:EnXjehVhgLiNnZb+8oZW1/QeeSsyE/qXIidEB1oES4YiPEK1vZH/jfq0dPpq7YDs:eG9MWFVtSEK1vZH/L0+JpY
- TLSH
  T141631E92774BCC39CBB33194E22C9E44FA65703952536C48F8AEB54F0AC5E72727163A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral15 behavioral16
- Target
  ZeuS 2.0.8.9/output/builder/zsb.exe
- Size 114KB
- SHA256 8d0c2823ce83734d7b5a583f936ca9dce566378ba2684853002a572210b68098
- MD5 f89c6263699ecb4716c0ae9e7033d9f2
- SHA1 e0ae875de0a7d53f92ff2ce5ea6bb7bd0c5370a8
- SHA512 a255d278e5d92564b3cf42eaaca2ec927f10df6f04cfba13e5de4bba56b8eaa4cc04f948fc070480165b8a7004daa5d251365424a9f897490a6e0dc4548dfbc7
- SSDEEP 1536:yca5FNZ98WiWRoAC8BBbXjjlYcirsR/4R6blh6WMw4fahzglv2Ni+d:yca5FbLiWdC8DbzhL23w4fAR7d
- TLSH
  T146B3F162F33F6852F571D134B398EF224AEA9EB4273D9502D0E8585ADE7E4627C042CD
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

6^/10

discovery upx
- Contacts third-party web service commonly abused for C2
  Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral17 behavioral18
- Target
  ZeuS 2.0.8.9/output/client32.bin
- Size 137KB
- SHA256 c980ee1107a12c2da7f71e10b3808e1c60481b1eb9d253ca3b387e5cb246ab50
- MD5 fac741d0618b82cdf7c41c89cffdb19e
- SHA1 4bae603e24ac042402555fdaefaecd5bfd8883bc
- SHA512 481127e049800d0c60190982d2a713c45af304bee3b565030866a32884f75535d788a5c9acc709843fde167f8dcdfee048a1f639145214375042cfa55942d77c
- SSDEEP 3072:/caqyte6nV77snHLLxtXyaXOqdPNbnhW4IxZx5kCZuubFrhU1wKKrONm:/caBtJ77snHRAY7PNNW4IxZ7zbC0rONm
- TLSH
  T12CD3AF677480A0B2C5A73671AEA9B36523FFDD3427389C83E3980D6925B1893771E347
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral19 behavioral20
- Target
  ZeuS 2.0.8.9/output/server/zsbcs.exe
- Size 7KB
- SHA256 f9db2b198d44e05c16ad57cd62e59e80fd6c67347e5409cdb8017e2a6f78a894
- MD5 f264336b29e8321be176eccef45d2b7c
- SHA1 d94f767c788d0faca7c8fe51ea427da4eafae3c1
- SHA512 29c11334e18052556114e3ae55e8751d118e60899e569407154a000c6083eceeb0870f79ffd14314e8105b732deb546542e05f8068f45b46277297a4101aea66
- SSDEEP 96:RFG753zeoM+Zcpo2KoMtOoivIZJUghKXXUneB2gwTO8ZaVUao1LAChdWXhy27:jGt3KoMSJ2P8xJUwKweIH/aSaC/whX7
- TLSH
  T12EE18E4A9C2C2C93DFC1263B924372921449727D03ABA195317F7508B1FFB2E8465BB9
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

5^/10

discovery upx
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral21 behavioral22
- Target
  ZeuS 2.0.8.9/source/client/core.cpp
- Size 46KB
- SHA256 dc1a9d91b2b01c5034ebe2fa106957c32ed1cc054440cbd16c1e255b36a531fe
- MD5 ba4f6282ce81a9a12bc099a5a9a059b4
- SHA1 dee383da47d51b46d9bd03673cfa2edbeb4751b3
- SHA512 c95bbc7a6c9b7f24a5418fddb7183d263171cb0708998e58211c6cb40baa3fef1fe776b6ace03feaf008cbcddf12de64bc9b733afe23a4c6e3c46b4bef05eaf0
- SSDEEP 768:zIVKDTgwnwiKZorJieKV+mWhnL7KQe0eh8jUcDWn:UuKVf38jUcDA
- TLSH
  T1D823E789549B513A65F30328B7538016DFC1621B03FA5B507DEEB2D03FB48A4A279FA7
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral23 behavioral24
- Target
  ZeuS 2.0.8.9/source/client/httpgrabber.cpp
- Size 43KB
- SHA256 fc409889cd75fc5d6211a8c6968119f079d971b10391b1aa70ad09ba18051c8a
- MD5 0464cb4f4bf60b53b6576eacaaf81cbb
- SHA1 c1fdbba012a06efaaf2191edaf964908d314ed03
- SHA512 cff9386e8308f606c18fc2aae8d26a29aaefef02138d63697de54f2f840ea62c74781f578d7a7d5dc358f666dd5d5700b6433ce1b435a98547089f047b412081
- SSDEEP 768:iPlyE3PPLCIT62SDTBwrz+ot5yfkVAant3I/Tzr:+lyEfPLCITpSHBwrz+ojyfkKat3I/Tzr
- TLSH
  T1391393D618926042A6F7D33AAF07C910EF63E62763D19A747C4D83E91FB92446270F93
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral25 behavioral26
- Target
  ZeuS 2.0.8.9/source/client/nspr4hook.cpp
- Size 45KB
- SHA256 91e66b143d4dcd451afea3631e3c8ba0b7258eef9917b966232be088d709c174
- MD5 968c69c5fed7baf6f94ffc7cabadd965
- SHA1 e419a5d8fc1707748602c6d61e72cc77f2dd648d
- SHA512 a5b20d3e1fbb05c7247578454b3597ade750cadb5fcd84492f3ff0a4b2871c988b48fbed2e5c8ebb3e3be6242b8c19ccd64d8d0bc01576cb7ea841d19fbb78b0
- SSDEEP 768:Jr74IQYYi9utUpQpHcerNXC6H2MboorzPMxfoQDP5/+CsV/rh911Faibi69Ppx0A:R26utU7erNXC6H2MboorzPMxfoQDP5/W
- TLSH
  T13F2385F220822165A773E22AFF838A05DBA1A52713E15561349C32FD2FB5350B9F1F97
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral27 behavioral28
- Target
  ZeuS 2.0.8.9/source/client/winapitables.cpp
- Size 14KB
- SHA256 2c006f74b1dd4297a2a409dfbc2ccc7539fa40f5d94bbfd880dceee23ea885f9
- MD5 804b0254b649c3911f2dad05f0df9ea4
- SHA1 caa276a99ddb9df68af1df313bc0e3de1b1aa40b
- SHA512 8207068c091f2e5b6358931de2ad56cc347464a4c76ca35751ce84ad7d61d29b94a945546724c8e113b082120d60c7003131af62f76e3c8394852c6bf4e2fb2b
- SSDEEP 192:zzpbB6CLqafvlnVtlo9WS8XwxKgp5ewck6bw/t5Ff/:RDqanRzSzdD/t5FH
- TLSH
  T1EB52116D70DF7060983603716B4B1CA6A5E8636B937161A1347EB2F8AF6647D376380C
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral29 behavioral30
- Target
  ZeuS 2.0.8.9/source/client/wininethook.cpp
- Size 32KB
- SHA256 48aee3eafa043ae9826f538ed2ed5377c6faf2744f9fccb4457647e1790cd1c8
- MD5 3e929ce256d0db3d97d6275fba24a7a2
- SHA1 863205765af8c19d0262db8a74d686ddee8bf31c
- SHA512 7b5da553f95050f85d508a1d6008436c655c2a7916b4a817481884b85822628ff62d7df33d9d2bd2f619d4b9c9137c221c038d23b226e6f4b317623c3c694b92
- SSDEEP 768:ibMWoFWo8ixdyzXe+fn+f6NM95i3bIUpz6xf9Fkwr2EDa8/kSu:i2q2yzXe+fn+yNM95i3bbwr2EDa8/kSu
- TLSH
  T1D6E2839164977220E6B362169B478905DE76E62327E14270398C33F85FF2290F5E6FCB
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral31 behavioral32

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

JavaScript

T1059.007

PowerShell

T1059.001

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Contacts third-party web service commonly abused for C2

UPX packed file

UPX packed file

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32