MALICIOUS — 926_ZeusGameover_Feb2014.bin

MALICIOUS — 926_ZeusGameover_Feb2014.bin is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (100/100), attributed to the Zbot family. 7 of 52 detection engines flagged it, exhibiting 1 ATT&CK technique.

Identification

SHA-256: 5ad62af46f8f47d683b87f935df20845075d2bf9098c4420b2463258f94b98b9
SHA-1: b1c59dea004e5feb57e9fa845c6f8abbe015e199
MD5: 7fe11cfcd7c66f7727cfc4613e755389
imphash: 1aa2253e29d2d08cca2710a5f1ab5cf1
ssdeep: 6144:Z1Yk7RnxF3BEuTP0PvdA8r1eqABpxEJPlLsiJEwpCzvkSm4krOsGDB:fYex0uT8Hq6eqABvuPl5K5RkvE
TLSH: T17045E1C6986E3740EAE5C1C16E904C9C425533E144EDFC6ABB00BE634FE56AF8D39249
Submitted as: 926_ZeusGameover_Feb2014.bin
File type: pe · Size: 285184 bytes
Verdict: malicious (100/100) · Family: Zbot

Detections (7 of 52 engines)

MalwareAnalyser heuristics (entropy/packer): high-entropy-sections:.text11
ClamAV (daily): {MD5}bin.trojan.zbot.9336.UNOFFICIAL
LIEF (executable format parser): lief:invalid-authenticode
Microsoft Defender: Trojan:Win32/Zbot.GPA!MTB
Emsisoft (Emergency Kit): Gen:Variant.Zbot.272
Trellix Stinger (McAfee): PWS-Zbot.gen.re
Kaspersky (KVRT): Trojan-Spy.Win32.Zbot.dmgf

MITRE ATT&CK

T1112

Why this verdict

The malicious score of 100/100 is the fusion of 10 weighted signals:

ClamAV (daily) flagged {MD5}bin.trojan.zbot.9336.UNOFFICIAL (rule {MD5}bin.trojan.zbot.9336.UNOFFICIAL) - engine signal, weight 0.90, confidence 0.95
Memory forensics: 5 finding(s), e.g. RWX/private injected region in WebExperienceH (pid 6196) (rule windows.malfind.Malfind) - memory signal, weight 0.60, confidence 0.85
Microsoft Defender flagged Trojan:Win32/Zbot.GPA!MTB (rule Trojan:Win32/Zbot.GPA!MTB) - engine signal, weight 0.55, confidence 0.85
Emsisoft (Emergency Kit) flagged Gen:Variant.Zbot.272 (rule Gen:Variant.Zbot.272) - engine signal, weight 0.55, confidence 0.85
Trellix Stinger (McAfee) flagged PWS-Zbot.gen.re (rule PWS-Zbot.gen.re) - engine signal, weight 0.55, confidence 0.85
Kaspersky (KVRT) flagged Trojan-Spy.Win32.Zbot.dmgf (rule Trojan-Spy.Win32.Zbot.dmgf) - engine signal, weight 0.55, confidence 0.85
Contacted 34 external host(s) at runtime (9 HTTP) - network signal, weight 0.40, confidence 0.80
LIEF (executable format parser) flagged lief:invalid-authenticode (rule lief:invalid-authenticode) - engine signal, weight 0.35, confidence 0.70
Packing/obfuscation: high-entropy-sections:.text11 - static signal, weight 0.25, confidence 0.55
Observed at runtime: Modify Registry (T1112) (rule Modify Registry) - dynamic signal, weight 0.12, confidence 0.90

Dynamic analysis (windows)

31 behavior events · 1 ATT&CK techniques · 3 dropped files.

Dropped files

9bc89a6f1b329831422880144e7a447f02f0ce7861f1eda097cf8d075dfdba27 - 9bc89a6f1b329831422880144e7a447f02f0ce7861f1eda097cf8d075dfdba27
01f151bb46356f3f3eaeaa73e25793f036c55ef50f3654e1b65596b0c42512ee - 01f151bb46356f3f3eaeaa73e25793f036c55ef50f3654e1b65596b0c42512ee
bf8bd5e5fc228fc4510c4edf91279f845d7122de0ddaf83538f11d1b71342b00 - bf8bd5e5fc228fc4510c4edf91279f845d7122de0ddaf83538f11d1b71342b00

Embedded URLs

http://www.msftconnecttest.com/connecttest.txt
http://c.pki.goog/r/gsr1.crl
http://c.pki.goog/r/r4.crl
http://c.pki.goog/we1/_-4iFwfCacM.crl

Embedded domains

inference.location.live.net
content.lifecycle.office.net

Embedded IP addresses

23.40.52.209
4.150.223.105
4.247.188.233
20.42.73.27
52.123.252.234
20.190.142.166
4.230.171.124
20.190.142.164
40.84.85.40
52.230.59.222
52.123.252.244
72.154.7.248
74.178.76.44
20.165.94.54
74.178.76.128
20.42.65.84
135.234.160.245
52.123.252.242
23.33.238.102
20.42.73.26
4.195.116.8
204.79.197.203
150.171.109.24
142.250.183.35
104.17.24.14

More Zbot samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report