MALICIOUS — 7187d24482803bf5ad96fd513084bb4344528b2da972b74582f26b1d41dfaaac

MALICIOUS — 7187d24482803bf5ad96fd513084bb4344528b2da972b74582f26b1d41dfaaac is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (99/100), attributed to the Zbot family. 5 of 56 detection engines flagged it, exhibiting 2 ATT&CK techniques.

Identification

SHA-256: 7187d24482803bf5ad96fd513084bb4344528b2da972b74582f26b1d41dfaaac
SHA-1: b5b51a69e46a08e58ac80af4f799117d06545eeb
MD5: 3fcd65c3267c4fa74298d21eaff55173
imphash: 187553847b5ea54b105cce03f3a97423
ssdeep: 3072:bgaqjuv8j6h+ZnuA5ErOOzdjY1aS9UXh02gfIbij6jXN:bLiuv8j7ZuA5ErOOze1QXh0jfLwd
TLSH: T1CD3ED0A8C7324326DAD08C363D5BAD0DF0165CADB51E5A4A440B663909FA3BBC7ED14C
Submitted as: 7187d24482803bf5ad96fd513084bb4344528b2da972b74582f26b1d41dfaaac
File type: pe · Size: 139188 bytes
Verdict: malicious (99/100) · Family: Zbot

Detections (5 of 56 engines)

MalwareAnalyser heuristics (entropy/packer): high-entropy-sections:.reloc2
ClamAV (daily): Win.Malware.Zbot-6919277-0
Microsoft Defender: Trojan:Win32/Gepys!pz
Emsisoft (Emergency Kit): Gen:Variant.Zbot.106
Kaspersky (KVRT): HEUR:Trojan.Win32.Generic

MITRE ATT&CK

Why this verdict

The malicious score of 99/100 is the fusion of 9 weighted signals:

ClamAV (daily) flagged Win.Malware.Zbot-6919277-0 (rule Win.Malware.Zbot-6919277-0) - engine signal, weight 0.90, confidence 0.95
Microsoft Defender flagged Trojan:Win32/Gepys!pz (rule Trojan:Win32/Gepys!pz) - engine signal, weight 0.55, confidence 0.85
Emsisoft (Emergency Kit) flagged Gen:Variant.Zbot.106 (rule Gen:Variant.Zbot.106) - engine signal, weight 0.55, confidence 0.85
Kaspersky (KVRT) flagged HEUR:Trojan.Win32.Generic (rule HEUR:Trojan.Win32.Generic) - engine signal, weight 0.55, confidence 0.85
Contacted 1 external host(s) and 18 HTTP request(s) at runtime - network signal, weight 0.40, confidence 0.80
MalwareAnalyser heuristics (entropy/packer) flagged high-entropy-sections:.reloc2 (rule high-entropy-sections:.reloc2) - engine signal, weight 0.35, confidence 0.70
Packing/obfuscation: high-entropy-sections:.reloc2 - static signal, weight 0.25, confidence 0.55
Dropped 2 executable file(s) at runtime - dynamic signal, weight 0.20, confidence 0.60
Observed at runtime: Modify Registry (T1112) (rule Modify Registry) - dynamic signal, weight 0.12, confidence 0.90

Dynamic analysis (windows)

3260 behavior events · 1 ATT&CK techniques · 6 dropped files.

Dropped files

C:\ProgramData\Mozilla\ohklkxk.exe - 1918ceb0b03351b19bd8a2bbc18806313402cf52fcf1239ab19ad61d56070066
C:\ProgramData\Mozilla\okszsmn.dll - 674d17873cbc50360ba361ba453157eb90c75086375476a32b536392326fc2f3
ab3c8ad66186c9ee6eba9a5ced0bcc18ce103ba78ac59b1f12747b79c04da29a - ab3c8ad66186c9ee6eba9a5ced0bcc18ce103ba78ac59b1f12747b79c04da29a
d24307507c4abfe82bc96e262b1dcbe9421854aa214ffb5576ad23791bd7499c - d24307507c4abfe82bc96e262b1dcbe9421854aa214ffb5576ad23791bd7499c
9a6de0c3253f46fc0982434fb4cca3477e1698b91f87b028a0066f7d17a3d521 - 9a6de0c3253f46fc0982434fb4cca3477e1698b91f87b028a0066f7d17a3d521
dd36b31ac7ee63e79f0ee1b1054a808e90be41532df945d3787521565038d73e - dd36b31ac7ee63e79f0ee1b1054a808e90be41532df945d3787521565038d73e

Embedded URLs

http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl
http://c.pki.goog/r/r1.crl
http://x2.c.lencr.org/
http://ye.c.lencr.org/
http://c.pki.goog/wr2/9UVbN0w5E6Y.crl
http://yr.c.lencr.org/

Embedded domains

x1.c.lencr.org
x2.c.lencr.org
ye.c.lencr.org
yr.c.lencr.org

Embedded IP addresses

20.42.65.90
52.123.252.242
4.230.171.124
172.215.188.225
20.247.184.142
135.232.92.137
135.232.92.97
20.42.65.91
20.184.175.6
52.110.12.55
52.110.12.10
20.184.175.2
4.150.223.111
57.155.101.212
72.145.35.99
52.148.114.188
52.110.12.49
52.110.12.30

More Zbot samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report