MALICIOUS — 927_ZeusGameover_Feb2014.bin

MALICIOUS — 927_ZeusGameover_Feb2014.bin is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (100/100), attributed to the Zbot family. 9 of 52 detection engines flagged it, exhibiting 4 ATT&CK techniques.

Identification

• SHA-256: 09e9fb8beb798f2c17a311d59c0a44d9e815d6cad8ea4feadd77a66d4d3706b5
• SHA-1: 81086a9559af3edc889f1c4c720460ebf49f8ef1
• MD5: 7bc463a32d6c0fb888cd76cc07ee69b5
• imphash: e5684f2db7b3e5d509ef24f1413bc2ae
• ssdeep: 6144:8fK9TB2jX+3PUdyj4oVDyLiMRgxnnMACDUprIvxo:8fK9ToaUd0PEi/RnDvwx
• TLSH: T11344AF125315A78AEDE6CB975C904E8E50FBE6D4A2FD2DCC01C6D05E26F088BA08716D
• Submitted as: 927_ZeusGameover_Feb2014.bin
• File type: pe · Size: 261120 bytes
• Verdict: malicious (100/100) · Family: Zbot

Detections (9 of 52 engines)

• YARA: MalwareAnalyser built-in: Windows_Injection_Api_Combo
• ClamAV (daily): Win.Trojan.Zeus-6412294-0
• YARA: JPCERT/CC: JPCERT_Emotet
• YARA: MalwareAnalyser community pack: TL_Shellcode_VirtualAlloc_Exec
• YARA: Yara-Rules community: YR_AntiDebug_Checks
• Microsoft Defender: PWS:Win32/Zbot.gen!AF
• Emsisoft (Emergency Kit): Gen:Heur.Mint.Dreidel.pmW@zm2hSGg
• Trellix Stinger (McAfee): PWS-Zbot.gen.ave
• Kaspersky (KVRT): HEUR:Trojan.Win32.Generic

MITRE ATT&CK

• T1055
• T1071.001
• T1057
• T1112

YARA

• Windows_Injection_Api_Combo

Why this verdict

The malicious score of 100/100 is the fusion of 15 weighted signals:

• ClamAV (daily) flagged Win.Trojan.Zeus-6412294-0 (rule Win.Trojan.Zeus-6412294-0) - engine signal, weight 0.90, confidence 0.95
• Process injection API combination (rule Windows_Injection_Api_Combo) - yara signal, weight 0.65, confidence 0.90
• Microsoft Defender flagged PWS:Win32/Zbot.gen!AF (rule PWS:Win32/Zbot.gen!AF) - engine signal, weight 0.55, confidence 0.85
• Emsisoft (Emergency Kit) flagged Gen:Heur.Mint.Dreidel.pmW@zm2hSGg (rule Gen:Heur.Mint.Dreidel.pmW@zm2hSGg) - engine signal, weight 0.55, confidence 0.85
• Trellix Stinger (McAfee) flagged PWS-Zbot.gen.ave (rule PWS-Zbot.gen.ave) - engine signal, weight 0.55, confidence 0.85
• Kaspersky (KVRT) flagged HEUR:Trojan.Win32.Generic (rule HEUR:Trojan.Win32.Generic) - engine signal, weight 0.55, confidence 0.85
• YARA: JPCERT/CC flagged JPCERT_Emotet (rule JPCERT_Emotet) - engine signal, weight 0.35, confidence 0.70
• YARA: MalwareAnalyser community pack flagged TL_Shellcode_VirtualAlloc_Exec (rule TL_Shellcode_VirtualAlloc_Exec) - engine signal, weight 0.35, confidence 0.70
• YARA: Yara-Rules community flagged YR_AntiDebug_Checks (rule YR_AntiDebug_Checks) - engine signal, weight 0.35, confidence 0.70
• Embedded network infrastructure: http://www.bing.com/ - static signal, weight 0.35, confidence 0.60
• communicate over HTTP (rule communicate over HTTP) - capa signal, weight 0.30, confidence 0.60
• enumerate processes (rule enumerate processes) - capa signal, weight 0.20, confidence 0.60
• Observed at runtime: Modify Registry (T1112) (rule Modify Registry) - dynamic signal, weight 0.12, confidence 0.90
• inject code into another process (rule inject code into another process) - capa signal, weight 0.12, confidence 0.60
• Contacted 1 external host(s) at runtime - network signal, weight 0.12, confidence 0.55

Dynamic analysis (windows)

20 behavior events · 1 ATT&CK techniques · 0 dropped files.

Runtime network

• www.msftconnecttest.com
• inference.location.live.net
• searchapp.bundleassets.example
• desktop-hsgcbep
• v10.events.data.microsoft.com
• settings-win.data.microsoft.com
• login.live.com
• config.edge.skype.com
• fd.api.iris.microsoft.com
• windows.msn.com
• officeclient.microsoft.com
• licensing.mp.microsoft.com
• sdx.microsoft.com
• nav.smartscreen.microsoft.com
• www.bing.com
• fe3cr.delivery.mp.microsoft.com
• oloobe.officeapps.live.com
• assets.msn.com
• dns.msftncsi.com
• msedge.api.cdp.microsoft.com

Embedded URLs

• http://www.bing.com/
• http://www.google.com/

Embedded domains

• www.bing.com
• www.google.com
• inference.location.live.net

Embedded IP addresses

• 162.159.36.2

More Zbot samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report