citadel | jaffacakes118_Trojan-Spy[.]Win32[.]Zbot[.]ntpf[.]672929a06f218fbfd9c50

Sharing

Copy URL Twitter E-mail

General

Target
jaffacakes118_Trojan-Spy.Win32.Zbot.ntpf.672929a06f218fbfd9c50
Size 221KB
Sample261016-db99vaz18n
SHA256 89533272a30df2fa21ee2ff271b3a950676fc088997ab9d6a393835cb7c3fc2b
MD5 b9b698b9b9d672929a06f218fbfd9c50
SHA1 2a76547a57fb92320aaf99e2fc130a1452aeab6f
SHA512 c7d67ad4bf99bd4f066d71a9f73b0bd456c1557b3eb4b3f07822c82170f92fe1d0abf750741ba9cd610395b6258ef2c754d9119a803ae4a07413ad212be596db
SSDEEP 6144:w0i0DmgSlqqDLPyOUvODvcDjoG1oPKajg3GqVmnO76kb:w0i0DmgBqnwkcDjoGyPKaE3Dd7Xb
TLSH
T1D124CF23B58060B7CAA31671AEAD776AA2FBC9346334DCC3E3244D692575543762E30F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

trojan botnet citadel

Malware Config

Signatures

Family: Citadel
Citadel is a trojan and botnet written in C.
trojan botnet citadel

Detects Citadel payload 1 IoCs

resource	yara_rule
sample	family_citadel

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
jaffacakes118_Trojan-Spy.Win32.Zbot.ntpf.672929a06f218fbfd9c50

File Explorer

jaffacakes118_Trojan-Spy.Win32.Zbot.ntpf.672929a06f218fbfd9c50

.exe 221KB

jaffacakes118_Trojan-Spy.Win32.Zbot.ntpf.672929a06f218fbfd9c50

IMPHASH cbd5f9d3d5116a19f639b439cc5737cd
SHA256 89533272a30df2fa21ee2ff271b3a950676fc088997ab9d6a393835cb7c3fc2b
MD5 b9b698b9b9d672929a06f218fbfd9c50
SHA1 2a76547a57fb92320aaf99e2fc130a1452aeab6f
SHA512 c7d67ad4bf99bd4f066d71a9f73b0bd456c1557b3eb4b3f07822c82170f92fe1d0abf750741ba9cd610395b6258ef2c754d9119a803ae4a07413ad212be596db
SSDEEP 6144:w0i0DmgSlqqDLPyOUvODvcDjoG1oPKajg3GqVmnO76kb:w0i0DmgBqnwkcDjoGyPKaE3Dd7Xb
TLSH
T1D124CF23B58060B7CAA31671AEAD776AA2FBC9346334DCC3E3244D692575543762E30F
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Detects Citadel payload
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

176213

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

LoadLibraryA Process32FirstW RemoveDirectoryW QueryDosDeviceW Process32NextW FindNextFileW VirtualProtect CreateToolhelp32Snapshot GetFileTime ReleaseMutex FileTimeToLocalFileTime GetVolumeNameForVolumeMountPointW DeleteFileW GetFileInformationByHandle LocalFree GetSystemTime WriteProcessMemory SetFileAttributesW CreateThread ExpandEnvironmentStringsW SetThreadPriority lstrcmpiA SetHandleInformation CreatePipe SetEvent OpenEventW GetCurrentThreadId TlsSetValue TerminateProcess ResetEvent FindClose UnmapViewOfFile CreateFileMappingW TlsAlloc TlsFree GetNativeSystemInfo GetVersionExW WTSGetActiveConsoleSessionId GlobalLock GlobalUnlock MoveFileExW GetCommandLineW SetErrorMode GetComputerNameW DuplicateHandle GetCurrentProcessId GetPrivateProfileStringW GetPrivateProfileIntW CreateRemoteThread GetModuleHandleA GetUserDefaultUILanguage GetFileAttributesW lstrcpynW HeapCreate HeapDestroy ReadProcessMemory Sleep LoadLibraryW WideCharToMultiByte Thread32First VirtualAllocEx VirtualProtectEx SetLastError GetLastError OpenMutexW GetFileSizeEx GetTempPathW FlushFileBuffers lstrlenW MultiByteToWideChar CreateFileW GetTimeZoneInformation ReadFile MapViewOfFile Thread32Next OpenProcess WriteFile VirtualQueryEx SetFileTime IsBadReadPtr GetProcessHeap VirtualFree GetCurrentThread CreateDirectoryW HeapFree GetLogicalDriveStringsW SetFilePointerEx GetCurrentProcess SystemTimeToFileTime HeapAlloc CreateProcessW FreeLibrary SetEndOfFile FindFirstFileW CreateMutexW HeapReAlloc WaitForSingleObject GetTempFileNameW FileTimeToDosDateTime GetEnvironmentVariableW lstrcmpiW GetProcAddress GetModuleFileNameW GetModuleHandleW GetFileAttributesExW GetProcessId EnterCriticalSection VirtualAlloc LeaveCriticalSection VirtualFreeEx InitializeCriticalSection SetThreadContext GetThreadContext ExitProcess CloseHandle WaitForMultipleObjects CreateEventW GetLocalTime ExitThread GetTickCount TlsGetValue

user32

CreateDesktopW SetProcessWindowStation GetThreadDesktop CloseWindowStation CreateWindowStationW GetProcessWindowStation OpenDesktopW CloseDesktop SetThreadDesktop GetUserObjectInformationW OpenWindowStationW CharLowerBuffA GetTopWindow LoadImageW WindowFromPoint IsRectEmpty CharToOemW GetWindowLongW CharLowerA CharUpperW SetWindowLongW SendMessageTimeoutW GetWindow DispatchMessageW GetMenuState GetMessageA GetUpdateRgn GetMessageW RegisterClassExA GetWindowDC SetCapture SendMessageW PrintWindow EqualRect PostThreadMessageW IntersectRect DrawEdge GetWindowInfo PostMessageW GetSystemMetrics MessageBoxA GetKeyboardLayoutList MapVirtualKeyW GetKeyboardState ToUnicode GetWindowRect GetParent GetClassLongW GetAncestor SetWindowPos IsWindow MapWindowPoints ExitWindowsEx RegisterWindowMessageW GetMenuItemID SetKeyboardState GetSubMenu MenuItemFromPoint GetMenuItemRect GetMenu TrackPopupMenuEx SystemParametersInfoW CharLowerW GetClassNameW DefDlgProcW DefFrameProcA OpenInputDesktop GetMenuItemCount HiliteMenuItem EndMenu GetWindowThreadProcessId GetShellWindow DrawIcon BeginPaint GetUpdateRect GetDC GetCapture TranslateMessage RegisterClassExW SetCursorPos GetClipboardData PeekMessageW GetDCEx PeekMessageA ReleaseDC DefWindowProcA GetCursorPos DefMDIChildProcW SwitchDesktop DefDlgProcA DefMDIChildProcA GetIconInfo EndPaint FillRect ReleaseCapture RegisterClassW CallWindowProcA CallWindowProcW DefWindowProcW GetMessagePos DefFrameProcW RegisterClassA MsgWaitForMultipleObjects

advapi32

CreateProcessAsUserA CreateProcessAsUserW CryptGetHashParam OpenProcessToken GetSidSubAuthority CryptAcquireContextW OpenThreadToken GetSidSubAuthorityCount GetTokenInformation RegCreateKeyExW CryptReleaseContext RegQueryValueExW InitializeSecurityDescriptor SetSecurityDescriptorDacl SetNamedSecurityInfoW LookupPrivilegeValueW AllocateAndInitializeSid CryptCreateHash ConvertStringSecurityDescriptorToSecurityDescriptorW FreeSid RegOpenKeyExW GetSecurityDescriptorSacl CheckTokenMembership SetSecurityDescriptorSacl CryptDestroyHash AdjustTokenPrivileges RegCloseKey RegSetValueExW CryptHashData RegCreateKeyW RegEnumKeyW RegQueryInfoKeyW SetSecurityInfo ConvertSidToStringSidW InitiateSystemShutdownExW EqualSid RegDeleteValueW RegEnumValueW IsWellKnownSid GetLengthSid RegEnumKeyExW

shlwapi

PathMatchSpecW StrStrIW StrStrIA PathQuoteSpacesW PathRenameExtensionW StrCmpNIW PathIsURLW wvnsprintfA StrCmpNIA UrlUnescapeA PathRemoveBackslashW PathUnquoteSpacesW PathAddExtensionW PathCombineW SHDeleteKeyW PathSkipRootW SHDeleteValueW PathAddBackslashW PathRemoveFileSpecW PathFindFileNameW PathIsDirectoryW wvnsprintfW

shell32

CommandLineToArgvW ShellExecuteW SHGetFolderPathW

secur32

GetUserNameExW

ole32

CoSetProxyBlanket CoUninitialize CLSIDFromString StringFromGUID2 CoInitializeSecurity CoInitialize CoInitializeEx CoCreateInstance

gdi32

DeleteObject GetDIBits GetDeviceCaps CreateDIBSection RestoreDC SaveDC CreateCompatibleDC SetRectRgn SelectObject GdiFlush DeleteDC SetViewportOrgEx CreateCompatibleBitmap

ws2_32

send gethostbyname closesocket WSASend getaddrinfo listen WSASetLastError freeaddrinfo inet_addr getpeername recvfrom WSAIoctl connect WSAAddressToStringW WSAStartup WSAEventSelect getsockname accept bind recv sendto setsockopt shutdown WSAGetLastError select socket

crypt32

CryptUnprotectData PFXExportCertStoreEx CertDuplicateCertificateContext CertEnumCertificatesInStore CertCloseStore CertOpenSystemStoreW CertDeleteCertificateFromStore PFXImportCertStore

wininet

HttpSendRequestW HttpOpenRequestA HttpOpenRequestW InternetSetFilePointer HttpSendRequestA InternetSetStatusCallbackA HttpAddRequestHeadersA InternetGetCookieA InternetSetStatusCallbackW GetUrlCacheEntryInfoW InternetQueryOptionA InternetOpenA HttpAddRequestHeadersW InternetSetOptionA InternetCrackUrlA InternetQueryOptionW InternetConnectA InternetCloseHandle HttpEndRequestW InternetReadFile HttpSendRequestExA HttpQueryInfoA HttpSendRequestExW InternetQueryDataAvailable InternetReadFileExA HttpEndRequestA

oleaut32

SysFreeString VariantInit SysAllocString VariantClear

netapi32

NetUserEnum NetApiBufferFree NetUserGetInfo

version

VerQueryValueW GetFileVersionInfoSizeW GetFileVersionInfoW

winmm

PlaySoundW waveOutSetVolume waveOutGetVolume PlaySoundA