MALICIOUS — 928_ZeusGameover_Feb2014.bin

MALICIOUS — 928_ZeusGameover_Feb2014.bin is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (100/100), attributed to the Zbot family. 9 of 52 detection engines flagged it, exhibiting 4 ATT&CK techniques.

Identification

• SHA-256: 2df5bbe0e055e2af7d32e3b71ea80b70f844a917229a6b7f9668eca31c3d813e
• SHA-1: 620262f1640db740fd60bd2a04b0b7435cff8b8c
• MD5: 19c68862d3a53ea1746180b40bf32226
• imphash: 464d3432fa6fd56ac0ac43426a73b13d
• ssdeep: 6144:n6WTBJzrllfU9Oz3o/Sz7ytG1Xpj0JOFPU5al:n6WTrzrlpqRk7f4Qu5
• TLSH: T1CC449E525315A78ADDE6CB135C908E1E50BBF2E8D2FE3DCC41CAD09E26E048B918625D
• Submitted as: 928_ZeusGameover_Feb2014.bin
• File type: pe · Size: 249344 bytes
• Verdict: malicious (100/100) · Family: Zbot

Detections (9 of 52 engines)

• YARA: MalwareAnalyser built-in: Windows_Injection_Api_Combo
• ClamAV (daily): Win.Spyware.Zbot-1275
• YARA: JPCERT/CC: JPCERT_Emotet
• YARA: MalwareAnalyser community pack: TL_Shellcode_VirtualAlloc_Exec
• YARA: Yara-Rules community: YR_AntiDebug_Checks
• Microsoft Defender: Trojan:Win32/Zbot.GPA!MTB
• Emsisoft (Emergency Kit): Trojan.Spy.Zbot.EVC
• Trellix Stinger (McAfee): PWS-Zbot.gen.ave
• Kaspersky (KVRT): Trojan-Spy.Win32.Zbot.qyhq

MITRE ATT&CK

• T1055
• T1071.001
• T1057
• T1112

YARA

• Windows_Injection_Api_Combo

Why this verdict

The malicious score of 100/100 is the fusion of 13 weighted signals:

• ClamAV (daily) flagged Win.Spyware.Zbot-1275 (rule Win.Spyware.Zbot-1275) - engine signal, weight 0.90, confidence 0.95
• Process injection API combination (rule Windows_Injection_Api_Combo) - yara signal, weight 0.65, confidence 0.90
• Microsoft Defender flagged Trojan:Win32/Zbot.GPA!MTB (rule Trojan:Win32/Zbot.GPA!MTB) - engine signal, weight 0.55, confidence 0.85
• Emsisoft (Emergency Kit) flagged Trojan.Spy.Zbot.EVC (rule Trojan.Spy.Zbot.EVC) - engine signal, weight 0.55, confidence 0.85
• Trellix Stinger (McAfee) flagged PWS-Zbot.gen.ave (rule PWS-Zbot.gen.ave) - engine signal, weight 0.55, confidence 0.85
• YARA: JPCERT/CC flagged JPCERT_Emotet (rule JPCERT_Emotet) - engine signal, weight 0.35, confidence 0.70
• YARA: MalwareAnalyser community pack flagged TL_Shellcode_VirtualAlloc_Exec (rule TL_Shellcode_VirtualAlloc_Exec) - engine signal, weight 0.35, confidence 0.70
• YARA: Yara-Rules community flagged YR_AntiDebug_Checks (rule YR_AntiDebug_Checks) - engine signal, weight 0.35, confidence 0.70
• Embedded network infrastructure: http://www.bing.com/ - static signal, weight 0.35, confidence 0.60
• communicate over HTTP (rule communicate over HTTP) - capa signal, weight 0.30, confidence 0.60
• enumerate processes (rule enumerate processes) - capa signal, weight 0.20, confidence 0.60
• Observed at runtime: Modify Registry (T1112) (rule Modify Registry) - dynamic signal, weight 0.12, confidence 0.90
• inject code into another process (rule inject code into another process) - capa signal, weight 0.12, confidence 0.60

Dynamic analysis (windows)

19 behavior events · 1 ATT&CK techniques · 0 dropped files.

Runtime network

• www.msftconnecttest.com
• inference.location.live.net
• searchapp.bundleassets.example
• desktop-hsgcbep
• v10.events.data.microsoft.com
• config.edge.skype.com
• login.live.com
• settings-win.data.microsoft.com
• www.bing.com
• fd.api.iris.microsoft.com
• windows.msn.com
• licensing.mp.microsoft.com
• msedge.api.cdp.microsoft.com
• officeclient.microsoft.com
• dns.msftncsi.com
• sdx.microsoft.com
• tas02.sls.update.microsoft.com
• nav.smartscreen.microsoft.com
• fe3cr.delivery.mp.microsoft.com
• assets.msn.com

Embedded URLs

• http://www.bing.com/
• http://www.google.com/

Embedded domains

• www.bing.com
• www.google.com
• inference.location.live.net

More Zbot samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report