MALICIOUS — 5fc0a3f285748b166f7dbfb8ed18d5dc017e6c6c591a2801d2d8e8123a98c550
MALICIOUS — 5fc0a3f285748b166f7dbfb8ed18d5dc017e6c6c591a2801d2d8e8123a98c550 is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (100/100), attributed to the ZBot family. 8 of 56 detection engines flagged it, exhibiting 2 ATT&CK techniques.
Identification
- SHA-256:
5fc0a3f285748b166f7dbfb8ed18d5dc017e6c6c591a2801d2d8e8123a98c550 - SHA-1:
bcbb69b9521c3f728fe71def6d2f79619988f847 - MD5:
7201d98d20481fc31bd09543aa562009 - imphash:
e5c8a33745610b86295c1c506cd5f4e4 - ssdeep:
3072:F1/LcgTsDAJJRjOMCAZ2l/uJrwhGHsVLFZhh2D+0caj3kyRACIhV:F1DdJJlzhJrzHsVn9ozIz - TLSH:
T126438B7A46E2EFCADA23345D17BE3B2E37D5643C0028A780A4468B5335989C7176743D - Submitted as: 5fc0a3f285748b166f7dbfb8ed18d5dc017e6c6c591a2801d2d8e8123a98c550
- File type: pe · Size: 230560 bytes
- Verdict: malicious (100/100) · Family: ZBot
Detections (8 of 56 engines)
- MalwareAnalyser heuristics (entropy/packer): MPRESS
- ClamAV (daily): Win.Packed.ZBot-7578445-1
- YARA: Yara-Rules community: YR_Packer_ASPack_MPRESS
- Detect It Easy (packer/type): DIE:MPRESS
- Microsoft Defender: Trojan:Win32/Zbot!pz
- Emsisoft (Emergency Kit): Trojan.Ransom.Cerber.1
- Trellix Stinger (McAfee): PWS-Zbot-FATG!7201D98D2048
- Kaspersky (KVRT): UDS:Trojan.Win32.ShipUp.bqh
MITRE ATT&CK
Why this verdict
The malicious score of 100/100 is the fusion of 12 weighted signals:
- ClamAV (daily) flagged Win.Packed.ZBot-7578445-1 (rule
Win.Packed.ZBot-7578445-1) - engine signal, weight 0.90, confidence 0.95 - Microsoft Defender flagged Trojan:Win32/Zbot!pz (rule
Trojan:Win32/Zbot!pz) - engine signal, weight 0.55, confidence 0.85 - Emsisoft (Emergency Kit) flagged Trojan.Ransom.Cerber.1 (rule
Trojan.Ransom.Cerber.1) - engine signal, weight 0.55, confidence 0.85 - Trellix Stinger (McAfee) flagged PWS-Zbot-FATG!7201D98D2048 (rule
PWS-Zbot-FATG!7201D98D2048) - engine signal, weight 0.55, confidence 0.85 - Kaspersky (KVRT) flagged UDS:Trojan.Win32.ShipUp.bqh (rule
UDS:Trojan.Win32.ShipUp.bqh) - engine signal, weight 0.55, confidence 0.85 - Contacted 6 HTTP request(s) at runtime - network signal, weight 0.40, confidence 0.80
- Detect It Easy (packer/type) flagged DIE:MPRESS (rule
DIE:MPRESS) - engine signal, weight 0.35, confidence 0.70 - MalwareAnalyser heuristics (entropy/packer) flagged MPRESS (rule
MPRESS) - engine signal, weight 0.35, confidence 0.70 - YARA: Yara-Rules community flagged YR_Packer_ASPack_MPRESS (rule
YR_Packer_ASPack_MPRESS) - engine signal, weight 0.30, confidence 0.70 - Packing/obfuscation: MPRESS - static signal, weight 0.25, confidence 0.55
- Dropped 2 executable file(s) at runtime - dynamic signal, weight 0.20, confidence 0.60
- Observed at runtime: Modify Registry (T1112) (rule
Modify Registry) - dynamic signal, weight 0.12, confidence 0.90
Dynamic analysis (windows)
3178 behavior events · 1 ATT&CK techniques · 6 dropped files.
Runtime network
- www.msftconnecttest.com
- rb.symcd.com
- rb.symcb.com
- inference.location.live.net
- ctldl.windowsupdate.com
- update.googleapis.com
- login.live.com
- desktop-hsgcbep
- v20.events.data.microsoft.com
- config.edge.skype.com
- windows.msn.com
- officeclient.microsoft.com
- www.msn.com
- odc.officeapps.live.com
- settings-win.data.microsoft.com
- assets.msn.com
- www.bing.com
- licensing.mp.microsoft.com
- fe3cr.delivery.mp.microsoft.com
- v10.events.data.microsoft.com
Dropped files
- C:\ProgramData\Mozilla\jbxjdjk.exe -
e562a58eddf106ccb6a79d7b3b8a6cff67325d648abc4cff0268343b9cab52d9 - C:\ProgramData\Mozilla\jfvghbh.dll -
1fe99f1e2a85fa658fbc24674485565288b8ae1ed7068985107d3068f12592cd - 2407c34d80d5e4b33e76930e1611e0f05e8df68435189433fee4e9af7c0e0948 -
2407c34d80d5e4b33e76930e1611e0f05e8df68435189433fee4e9af7c0e0948 - 6b263bd859b962bfb70d1ec63639a6967a2de5be0486008586c08875d318b2b5 -
6b263bd859b962bfb70d1ec63639a6967a2de5be0486008586c08875d318b2b5 - 68236cf215684b6e3f1e7f7e782b8e64dc678322dd0f1cd49fafe4c4a3c28416 -
68236cf215684b6e3f1e7f7e782b8e64dc678322dd0f1cd49fafe4c4a3c28416 - e3d1e8bb1bdabd62b9783f8a4f64ea08fb4055ccf5a12f580fb932c37f2d3c0e -
e3d1e8bb1bdabd62b9783f8a4f64ea08fb4055ccf5a12f580fb932c37f2d3c0e
Embedded URLs
- http://www.msftconnecttest.com/connecttest.txt
- http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
- http://rb.symcb.com/rb.crl
Embedded IP addresses
- 52.182.143.212
- 52.123.252.245
- 4.230.171.124
- 40.84.85.40
- 4.144.132.223
- 74.178.240.51
- 20.42.72.131
- 20.165.94.63
- 20.247.185.124
- 172.215.188.225
- 20.184.175.14
- 20.42.65.93
- 72.153.5.131
- 52.148.114.188
- 52.110.12.26
- 52.110.12.30
More ZBot samples · Latest analyzed threats · ATT&CK coverage
Analyzed on MalwareAnalyzer by Cyble · Open interactive report