f8d6c91360219545531eb459ed229a3f8bd344fe48d8531a6fcb9e6d37a7c585

Sharing

Copy URL Twitter E-mail

General

Target
Zeus RAT.7z
Size 1.4MB
Sample260912-zywwmaxvfs
SHA256 f8d6c91360219545531eb459ed229a3f8bd344fe48d8531a6fcb9e6d37a7c585
MD5 a60b83330da981d84f4626203a023274
SHA1 bdfc7851dafa7daca5ed39d81507e47f78ea4de5
SHA512 d934aa1e6d32b32f9ce5efd557c2db80392fbdf57eaae0b9ac2d565f52d9286c139e0fdf487559bbcba417257130c44955ef13eb5c577431f7cdb868451d32f6
SSDEEP 24576:V7eTfBosnfzCGI/TvhfMIF1uyTOG86mjAiziVXj/ASKf5oc3oRcw0G52V5Kg5:2GIupTRpOyr8xjrziWbfScYx0TYg5
TLSH
T1396533A27E0765E8C51418E30BBFE8D7D464349E323452E2B69DCE0FAE5733E92649D0
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

Malware Config

Targets

- Target
  Zeus RAT/Animator.dll
- Size 45KB
- SHA256 a085664881d0ba1916129de8cfe9bc7e29d6a973e6cb4eb56e849b643f21cd68
- MD5 6c7a140d5620fefb4946b4fff1e93235
- SHA1 a6659160f17f6d10a482c14a081bed5886d68c47
- SHA512 7a9deaf454a4257bb1b717ce78cf09ab1ded71e39fc7132a00e04500dc1511dbf826e1e61b238bcd07d286ffd7a96894e048bfb15a1c7cc3eef077e9abb67651
- SSDEEP 768:qeWYYuIkmObANAa9+2jkb/fkFr1FfHVeLjXsJsMLk5CiMzxzuHOZIsB:86F/fyZFfHY/9MxiIzuHOz
- TLSH
  T1EB2319261F2CC77BCA6E5339E166A11113F4C2C13642EBDA5D81B8FA389774687162F3
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral1 behavioral2
- Target
  Zeus RAT/Bunifu_UI_v1.5.3.dll
- Size 236KB
- SHA256 f1b3e0f2750a9103e46a6a4a34f1cf9d17779725f98042cc2475ec66484801cf
- MD5 2ecb51ab00c5f340380ecf849291dbcf
- SHA1 1a4dffbce2a4ce65495ed79eab42a4da3b660931
- SHA512 e241a48eafcaf99187035f0870d24d74ae97fe84aaadd2591cceea9f64b8223d77cfb17a038a58eadd3b822c5201a6f7494f26eea6f77d95f77f6c668d088e6b
- SSDEEP 6144:SIQpxILDXGGMO7Ice9C5kQw2hWHcHTykhb:SIQpxILDXGGlET9n/cHG
- TLSH
  T19D345B1137A88D6BC67E4BFEA4A40240D7B2F956B1DADBCF9D9510FD24C33664B02263
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral3 behavioral4
- Target
  Zeus RAT/MaterialSkin.dll
- Size 574KB
- SHA256 a854c68221a02576e0d61f54150b202613b3f3836ae949ba151c7af9fb41143d
- MD5 1e09ddb8e2f93dd0b89324631d4e964b
- SHA1 a2c3a096ab274fd7667707271181ffebcc885fcf
- SHA512 a6b6eafbe5cad11cab8340c97ad360fda3d678184f08f0f11ccbe69ea3c76a1a9e7eccd5c3a07c072cfbbb1596581c65497fb5dce968a3b173119ecc6e7792a9
- SSDEEP 12288:iE7LkkxswcXKC2zNWfm2YRm5sm2YRm5hkxswcXKC2zNW:VkZX9uWfm2Yysm2YyhZX9uW
- TLSH
  T125C48D0A73129719D9656E7885A1C3603735FF6AFB03970BB2BEFB6026431B01DE91D8
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral5 behavioral6
- Target
  Zeus RAT/MetroFramework.DLL
- Size 345KB
- SHA256 c2c12d31b4844e29de31594fc9632a372a553631de0a0a04c8af91668e37cf49
- MD5 34ea7f7d66563f724318e322ff08f4db
- SHA1 d0aa8038a92eb43def2fffbbf4114b02636117c5
- SHA512 dceb1f9435b9479f6aea9b0644ba8c46338a7f458c313822a9d9b3266d79af395b9b2797ed3217c7048db8b22955ec6fe8b0b1778077fa1de587123ad9e6b148
- SSDEEP 6144:M4S7k5hdCpU4YqfkUGz6KpQQZQHDXjNCdOZgLdL5DXBK:M4S7k5hdCEQHP1Zgj
- TLSH
  T1C8745C111399452AE1FF423AB457084187F7AE12F6BEEBAD69CCE0EC5F937414A42363
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral7 behavioral8
- Target
  Zeus RAT/MetroFramework.Design.dll
- Size 16KB
- SHA256 0a4a96082e25767e4697033649b16c76a652e120757a2cecab8092ad0d716b65
- MD5 ab4c3529694fc8d2427434825f71b2b8
- SHA1 7be378e382e43eae84f1567b3570bca9a67e7697
- SHA512 02d7935f68c30457da79ad7b039b22caed11d8aedfec7c96619ac6da59ceb7c5e7a758dced64ec02d31c37a2befccdc8eb59be9e2dc849aa2bc22fabb5fa00a5
- SSDEEP 384:HYAB8KPALBamLG3gckiBTVU6sgFf5L7WTOYKpKG4rw:HyLBamS3gckiBTVkgiVXr
- TLSH
  T114723205B2FC423AE7EFC5336BA945503D74A90DA872CA1C1CE80AF959F67424AD1F53
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral10 behavioral9
- Target
  Zeus RAT/MetroFramework.Fonts.dll
- Size 656KB
- SHA256 c843869aaca5135c2d47296985f35c71ca8af4431288d04d481c4e46cc93ee26
- MD5 65ef4b23060128743cef937a43b82aa3
- SHA1 cc72536b84384ec8479b9734b947dce885ef5d31
- SHA512 d06690f9aac0c6500aed387f692b3305dfc0708b08fc2f27eaa44b108908ccd8267b07f8fb8608eef5c803039caeabf8f88a18b7e5b1d850f32bbb72bcd3b0b7
- SSDEEP 12288:O+/9JcJlYqCNktA+SXfGpq2fHowSqCNktA+SXfvJR9FrIJJaqCNktA+SXfUC:O+/3qlrCNoh+UqgIwhCNoh+JR9FrIJJw
- TLSH
  T1D2E429B5760139E6EF11C4B7C260FD80192BB863A77B402A68E3077A88575CDFE53E46
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral11 behavioral12
- Target
  Zeus RAT/Zeus Remote Administration Tool.exe
- Size 2.1MB
- SHA256 ad20084df5662d5a6960baafb4be7d276088b40df6dcdc3fa802d9c8ad47b092
- MD5 be87f9d1f5ea8aec927adc8ee7bbe1ba
- SHA1 a02f35f5b91fd7c4b6833166c2625e87b678f46c
- SHA512 5232e1e00c7b310296bdeeb6793bf76397635b0bf8f26c9044712c279e5e77c5f7b8dd34eb6f3a84cfa3d6bc0d4e44a7ac658e6974ec078e03cc6d46d85fbaa9
- SSDEEP 49152:FeZ7eZVeZUeZ3eZiUseZESeZIeZQeZPeZMeZVeZVeZP+5fAfkWUOgnoZ9GUr/Wqz:F878V8U83808ES8I8Q8P8M8V8V8mfAfB
- TLSH
  T1FAA58CA36190C909E0FA5BF1D01283A05FB3EC196F57F144AA6974AC58FDECEE2D56C0
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

credential_access defense_evasion discovery persistence privilege_escalation spyware stealer
- Creates a file in the Startup directory
  A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.
  persistence privilege_escalation
- Executes dropped EXE
- Reads data files stored by FTP clients
  Tries to access configuration files associated with programs like FileZilla.
  spyware stealer
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Unsecured Credentials: Credentials In Files
  Steal credentials from unsecured files.
  credential_access stealer
- Adds Run key to start application
  persistence
behavioral13 behavioral14