MALICIOUS — e00b4b88fd048bcdd126bae9be0fca7b119f7a59b65d1caf055d324d9d51f5bb

MALICIOUS — e00b4b88fd048bcdd126bae9be0fca7b119f7a59b65d1caf055d324d9d51f5bb is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (100/100), attributed to the Zbot family. 7 of 56 detection engines flagged it, exhibiting 2 ATT&CK techniques.

Identification

SHA-256: e00b4b88fd048bcdd126bae9be0fca7b119f7a59b65d1caf055d324d9d51f5bb
SHA-1: 79df86cdfec918e9c59193c98381e74c59104168
MD5: 564c0e15832cb136d4c6d523c88adb7c
imphash: 2862b104728a57b816f62e68d637709e
ssdeep: 3072:b2xGEOR2rnCpyRLdnN04Clc/VyS3oBxRm50tRAtK296O+6LPmqVwi:SxGV2r2YL44gRyou6tYix6LPWi
TLSH: T15A3F12F7928822BAF2246CC15C55FCCD9AD53D8A818C0B9DA1C63F9C4EEDA130727156
Submitted as: e00b4b88fd048bcdd126bae9be0fca7b119f7a59b65d1caf055d324d9d51f5bb
File type: pe · Size: 152352 bytes
Verdict: malicious (100/100) · Family: Zbot

Detections (7 of 56 engines)

MalwareAnalyser heuristics (entropy/packer): high-entropy-sections:.MPRESS1
ClamAV (daily): Win.Packed.Zbot-9867417-0
YARA: Yara-Rules community: YR_Packer_ASPack_MPRESS
Detect It Easy (packer/type): DIE:MPRESS
Microsoft Defender: Trojan:Win32/Zbot.SIBL!MTB
Emsisoft (Emergency Kit): Gen:Variant.Cafiko.1
Kaspersky (KVRT): HEUR:Trojan.Win32.Generic

MITRE ATT&CK

Why this verdict

The malicious score of 100/100 is the fusion of 11 weighted signals:

ClamAV (daily) flagged Win.Packed.Zbot-9867417-0 (rule Win.Packed.Zbot-9867417-0) - engine signal, weight 0.90, confidence 0.95
Microsoft Defender flagged Trojan:Win32/Zbot.SIBL!MTB (rule Trojan:Win32/Zbot.SIBL!MTB) - engine signal, weight 0.55, confidence 0.85
Emsisoft (Emergency Kit) flagged Gen:Variant.Cafiko.1 (rule Gen:Variant.Cafiko.1) - engine signal, weight 0.55, confidence 0.85
Kaspersky (KVRT) flagged HEUR:Trojan.Win32.Generic (rule HEUR:Trojan.Win32.Generic) - engine signal, weight 0.55, confidence 0.85
Contacted 3 external host(s) and 6 HTTP request(s) at runtime - network signal, weight 0.40, confidence 0.80
Detect It Easy (packer/type) flagged DIE:MPRESS (rule DIE:MPRESS) - engine signal, weight 0.35, confidence 0.70
MalwareAnalyser heuristics (entropy/packer) flagged high-entropy-sections:.MPRESS1 (rule high-entropy-sections:.MPRESS1) - engine signal, weight 0.35, confidence 0.70
YARA: Yara-Rules community flagged YR_Packer_ASPack_MPRESS (rule YR_Packer_ASPack_MPRESS) - engine signal, weight 0.30, confidence 0.70
Packing/obfuscation: high-entropy-sections:.MPRESS1, MPRESS - static signal, weight 0.25, confidence 0.55
Dropped 2 executable file(s) at runtime - dynamic signal, weight 0.20, confidence 0.60
Observed at runtime: Modify Registry (T1112) (rule Modify Registry) - dynamic signal, weight 0.12, confidence 0.90

Dynamic analysis (windows)

3140 behavior events · 1 ATT&CK techniques · 6 dropped files.

Dropped files

C:\ProgramData\Mozilla\vlkepvm.exe - ddeebf35f0f43f1ebb042c416cd22fedcb9a6cacfa55f78b2415a2b46e21fe14
C:\ProgramData\Mozilla\onyhpmg.dll - a5ca520008f06b3021c4b8341a7ed97bcc3e1bf63ed73e10413e8d9b5aee0ed2
643b9f9c9a59a10d8a7891677ad13dbe235535ddd934b0a7ea538064be193964 - 643b9f9c9a59a10d8a7891677ad13dbe235535ddd934b0a7ea538064be193964
bfd5c2dcb1ff9b00365005bed6f25da65c283f96d9cc32ac37ad6006a00c7574 - bfd5c2dcb1ff9b00365005bed6f25da65c283f96d9cc32ac37ad6006a00c7574
1539eb8550ca6bfb558aa9fe69aaa6578d6fe6695fcf01cfd43d8adfd8d3c173 - 1539eb8550ca6bfb558aa9fe69aaa6578d6fe6695fcf01cfd43d8adfd8d3c173
33d52f4f39e55caaeb0c9e4b30e6aa9052cc6ad9aa737e01982449c3d30996e1 - 33d52f4f39e55caaeb0c9e4b30e6aa9052cc6ad9aa737e01982449c3d30996e1

Embedded URLs

http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl
http://203.26.79.13/filestreamingservice//files/89c77c08-6078-44b6-8f27-85720154df65/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/89c77c08-6078-44b6-8f27-85720154df65?P1=1788019582&P2=404&P3=2&P4=H%2bT2IEj2LVVYScMGKT%2f1vZOS%2b8O9TK%2brxRe7dGN49pMBpWK21kegKxGMXm5%2fUY28sz7I4iDEv7D8xYNkC30xQg%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com

Embedded domains

2jm.ws

Embedded IP addresses

20.42.73.31
20.247.184.142
4.230.171.124
135.232.92.97
135.232.92.137
85.210.193.152
20.42.73.30
92.223.78.30
20.165.94.46
203.26.79.13
57.154.63.210
52.110.12.44
52.110.12.20
52.148.114.188
52.110.12.16
52.110.12.30
72.145.35.98

More Zbot samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report