MALICIOUS — 085004bd01e35e5d0e2ba93ae4307f2fe94c4d625652216cf9e7fa3d53519279

MALICIOUS — 085004bd01e35e5d0e2ba93ae4307f2fe94c4d625652216cf9e7fa3d53519279 is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (99/100), attributed to the Zbot family. 8 of 55 detection engines flagged it, exhibiting 3 ATT&CK techniques.

Identification

SHA-256: 085004bd01e35e5d0e2ba93ae4307f2fe94c4d625652216cf9e7fa3d53519279
SHA-1: 5d9abbbf5bbe4de496e46760c7e23e27f6f353a0
MD5: f77a1f97ac68f390e3404d48ddb4b5c5
imphash: 1d14792f4436a657513c58afc8aaabcd
ssdeep: 768:xQz7yVEhs9+4uR1bytOOtEvwDpjWfbZ7uyA36S7MzcneMU:xj+VGMOtEvwDpjubwQEDRU
TLSH: T111360CCC41B80B2BC33A14F44676D95F919AF0E11DEC750A598DA13DA0C68F3AD62E36
Submitted as: 085004bd01e35e5d0e2ba93ae4307f2fe94c4d625652216cf9e7fa3d53519279
File type: pe · Size: 64444 bytes
Verdict: malicious (99/100) · Family: Zbot

Detections (8 of 55 engines)

MalwareAnalyser heuristics (entropy/packer): MPRESS
ClamAV (daily): Win.Trojan.Zbot-64721
YARA: Yara-Rules community: YR_Packer_ASPack_MPRESS
Detect It Easy (packer/type): DIE:MPRESS
Microsoft Defender: PWS:Win32/Zbot!pz
Emsisoft (Emergency Kit): Gen:Variant.Ransom.CryptoLocker.25
Trellix Stinger (McAfee): PWSZbot-FIE!F77A1F97AC68
Kaspersky (KVRT): HEUR:Trojan.Win32.Convagent.gen

MITRE ATT&CK

Why this verdict

The malicious score of 99/100 is the fusion of 10 weighted signals:

ClamAV (daily) flagged Win.Trojan.Zbot-64721 (rule Win.Trojan.Zbot-64721) - engine signal, weight 0.90, confidence 0.95
Observed at runtime: Windows Service (T1543.003) (rule Windows Service) - dynamic signal, weight 0.40, confidence 0.90
1 behavioral detection(s): Windows Service Installation [medium] (rule tl-service-install) - dynamic signal, weight 0.40, confidence 0.90
Contacted 22 external host(s) at runtime (21 HTTP) - network signal, weight 0.40, confidence 0.80
Anti-analysis: T1497.001, T1082, T1622 - dynamic signal, weight 0.40, confidence 0.75
YARA: Yara-Rules community flagged YR_Packer_ASPack_MPRESS (rule YR_Packer_ASPack_MPRESS) - engine signal, weight 0.35, confidence 0.70
Detect It Easy (packer/type) flagged DIE:MPRESS (rule DIE:MPRESS) - engine signal, weight 0.35, confidence 0.70
Packing/obfuscation: MPRESS - static signal, weight 0.25, confidence 0.55
Dropped 1 executable file(s) at runtime - dynamic signal, weight 0.20, confidence 0.60
Observed at runtime: Modify Registry (T1112) (rule Modify Registry) - dynamic signal, weight 0.12, confidence 0.90

Dynamic analysis (windows)

12129 behavior events · 2 ATT&CK techniques · 7 dropped files.

Dropped files

C:\Users\analyst\AppData\Local\Temp\misid.exe - 16b549be82bc33762bd8d57e45b5a8d63f60a839bb739304f081bb75913db6a1
7b50807c7e0aeb32e15dc7682905b74087dbfd37398d43f6074d15b16bb8b875 - 7b50807c7e0aeb32e15dc7682905b74087dbfd37398d43f6074d15b16bb8b875
43d43170dae7f97e6f8f3785492f5dee9d9de050cbced073d9106117315ae707 - 43d43170dae7f97e6f8f3785492f5dee9d9de050cbced073d9106117315ae707
4228dc55debae959142ca74d4adc6a39dd9c1ee5739756cc13211e344853c0ff - 4228dc55debae959142ca74d4adc6a39dd9c1ee5739756cc13211e344853c0ff
52b7e58dcfac15588a22c9b112907322a38b7953dde489b09430a5f3cffd5e4e - 52b7e58dcfac15588a22c9b112907322a38b7953dde489b09430a5f3cffd5e4e
3fb40c4273cb23e2c01f581a859d8a8d2dc64c51a8be6b38d84c462e9d0b8e08 - 3fb40c4273cb23e2c01f581a859d8a8d2dc64c51a8be6b38d84c462e9d0b8e08
096328ab9b78cb116fa7f2d317fed22541404459cadc0545c8e1eced4a5f3d65 - 096328ab9b78cb116fa7f2d317fed22541404459cadc0545c8e1eced4a5f3d65

Embedded URLs

http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl
http://203.26.79.13/filestreamingservice//files/753bb2df-a166-494f-aa7d-5678b1ef0c56/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/753bb2df-a166-494f-aa7d-5678b1ef0c56?P1=1787833898&P2=404&P3=2&P4=MSxyZqdOpX7WI4%2bj4NvY2C1J3iSgzNvyufufXSivDvyZpM8sRfhJ5B3PFEBeyVS0bJgmEMBQacvjPoazFeZdng%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice//files/c74a5353-3e6a-42b7-94d6-9b96c560c89a/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/c74a5353-3e6a-42b7-94d6-9b96c560c89a?P1=1787833967&P2=404&P3=2&P4=j6tt5EX6rxs24hi147PZ%2bYHDRt28bEQD3mDgJK%2fWzYLyaJ%2f0QpY0iW%2fviTjkUs%2fEiLiT%2fbY5ToRptzOcOsTacw%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com

Embedded domains

bestccc.com

Embedded IP addresses

52.168.117.169
48.211.4.16
4.230.171.124
4.144.132.114
135.232.92.137
4.150.223.102
74.179.77.164
52.123.129.14
20.112.250.133
52.123.128.14
104.208.16.94
135.233.45.222
135.233.45.223
203.26.79.13
52.148.114.188
20.42.65.93
52.168.117.175
52.123.252.234
74.178.76.44
72.154.7.104
52.110.12.37
52.110.12.8

File paths

C:\7Yn74cF4.exe
C:\w_KyqlKO.exe
C:\lpdC2ee1.ex
C:\Documents
C:\54186b65b4b56b164bc283e391b61ed0b56fd4faf20b3498cf5d5c192ddb2624
C:\c6fea76a5ca0644d587d8fc31e8408c53a5becd7c96558662274fcc48271b7d1
C:\Users\admin\Downloads\4c9fce5dc799931ac271030a79be077cc0c7bef45f7c32e6337173b843b24c89.exe
C:\8c73e9be458dd024b1ba0ab32ea3adf6b1453fd3e9a6e898164ae4ced8355623
C:\64b536e73d4bee32d3a921f8891789e6e077a6d375dccdeb66bbb34c99c4b1ee
C:\84e5525cd48c5e4059665c36f2953483802cc6296149bcdc7536c6d1c06817c8
C:\8c2aa86717e8f9dd94178611a86f91782083877dbd3b86299f389301c8fbc323
C:\Users\Lisa\Desktop\zUOwiqmJ.exe
C:\042b787afb5ebe06e9205a303f29cf554a29c966d2481775bb25294a00d161b4
C:\Users\admin\Downloads\misid.exe
C:\Users\Virtual\AppData\Local\Temp\e4a1d4d803fe2769548d7fa377598e4c5399396e06ff92198b8d8682f7a79c62.exe
C:\df5357bdbd87be93bb1a85bf13db13394ca1bac5d42acec6c4f575af6cfa011f
C:\4fbc938fdca6c169ebe60193654f6117e0717215c788c0bf1959a90b1ef6c28f
C:\1b1a4c0e8fadd81d89645b8e9e0c1e2cbc97e957c24169a781e69d2327d9aba5
C:\Users\Lisa\Desktop\KbC7yHEA.exe
C:\49b5d08d8906d1fca8a50268d5ede3167b3b1357251e180a923749df826472e8
C:\Users\Petra\AppData\Local\Temp\misid.pe32
C:\1d6527d2ed5c1c8e055193efad3d8b819116e8cbed32d9cf14d16a5435f6c73c
C:\Users\admin\Downloads\c9ee8f799300b858c11a8977ebd2ee7ee83f35a53e3db6ed6206ee1e97251509.exe
C:\d42b31a675252b74d30a403eed7dd7ce8f46f728b2fd489340d1ae26b72f5cb0
C:\ICo3rjDf.exe

More Zbot samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report