MALICIOUS — c43c6aa39f20e23b37e7972e3b8edee15d665a63450de404dd580dba962493b3

MALICIOUS — c43c6aa39f20e23b37e7972e3b8edee15d665a63450de404dd580dba962493b3 is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (97/100), attributed to the Zbot family. 5 of 52 detection engines flagged it.

Identification

• SHA-256: c43c6aa39f20e23b37e7972e3b8edee15d665a63450de404dd580dba962493b3
• SHA-1: 882d55411ec02dba127dba482cf10e0a7cacbaa8
• MD5: 4c040c98ff27a5fb0a79461ada89feb8
• imphash: 6a01fc6123ffae0fae2c4f39fd37f27e
• ssdeep: 6144:vom2efufqcdzfvV4PdAJk0woMhR3lv2XGKbcguRY/KMRAB:AmD2CcdbvV4mJkdVR3lv2XfcrRBjB
• TLSH: T10447DF4B15F1BE94E49A09D6D02DE4AC305F82A5B01F03CDB5B7BF8E6D360EB6520A41
• Submitted as: c43c6aa39f20e23b37e7972e3b8edee15d665a63450de404dd580dba962493b3
• File type: pe · Size: 348954 bytes
• Verdict: malicious (97/100) · Family: Zbot

Detections (5 of 52 engines)

• ClamAV (daily): Win.Trojan.Redirect-6055402-0
• YARA: JPCERT/CC: JPCERT_HUILoader_PlugX_SideLoad
• Microsoft Defender: PWS:Win32/Zbot!pz
• Trellix Stinger (McAfee): PWS-Zbot-FATG!4C040C98FF27
• Kaspersky (KVRT): UDS:Trojan.Win32.ShipUp.bpu

Why this verdict

The malicious score of 97/100 is the fusion of 4 weighted signals:

• ClamAV (daily) flagged Win.Trojan.Redirect-6055402-0 (rule Win.Trojan.Redirect-6055402-0) - engine signal, weight 0.90, confidence 0.95
• Microsoft Defender flagged PWS:Win32/Zbot!pz (rule PWS:Win32/Zbot!pz) - engine signal, weight 0.55, confidence 0.85
• Trellix Stinger (McAfee) flagged PWS-Zbot-FATG!4C040C98FF27 (rule PWS-Zbot-FATG!4C040C98FF27) - engine signal, weight 0.55, confidence 0.85
• YARA: JPCERT/CC flagged JPCERT_HUILoader_PlugX_SideLoad (rule JPCERT_HUILoader_PlugX_SideLoad) - engine signal, weight 0.35, confidence 0.70

Dynamic analysis (windows)

0 behavior events · 0 ATT&CK techniques · 0 dropped files.

Runtime network

• none

More Zbot samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report