MALICIOUS — 1d321d3f783ba92d76bef18af22d0a0074c192d3af5d88cad1afd808fb453380

MALICIOUS — 1d321d3f783ba92d76bef18af22d0a0074c192d3af5d88cad1afd808fb453380 is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (98/100), attributed to the Zbot family. 4 of 52 detection engines flagged it.

Identification

• SHA-256: 1d321d3f783ba92d76bef18af22d0a0074c192d3af5d88cad1afd808fb453380
• SHA-1: 8dad83421a56ce71eaca31c81be2afed8999e18f
• MD5: 06ff62b8e88cfd7cdf4a8c34ae53f354
• imphash: d41d8cd98f00b204e9800998ecf8427e
• File type: pe · Size: 347391 bytes
• Verdict: malicious (98/100) · Family: Zbot

Detections (4 of 52 engines)

• MalwareAnalyser heuristics (entropy/packer): high-entropy-sections:.text
• ClamAV (daily): Win.Packed.Zbot-9797509-0
• Microsoft Defender: PWS:Win32/Zbot!rfn
• Kaspersky (KVRT): VHO:Trojan-PSW.Win32.Fareit.gen

Dynamic analysis (windows)

9 behavior events · 0 ATT&CK techniques · 0 dropped files.

Runtime network

• www.msftconnecttest.com
• inference.location.live.net
• ctldl.windowsupdate.com
• login.live.com
• ocsp.digicert.com
• desktop-hsgcbep
• v20.events.data.microsoft.com
• config.edge.skype.com
• windows.msn.com
• oneocsp.microsoft.com
• www.msn.com
• officeclient.microsoft.com
• odc.officeapps.live.com
• settings-win.data.microsoft.com
• msedge.api.cdp.microsoft.com
• licensing.mp.microsoft.com
• assets.msn.com
• geo.prod.do.dsp.mp.microsoft.com
• kv801.prod.do.dsp.mp.microsoft.com
• cp801.prod.do.dsp.mp.microsoft.com

Embedded URLs

• http://www.msftconnecttest.com/connecttest.txt
• http://203.26.79.13/filestreamingservice//files/736bdc20-582e-46c5-ba31-d31d3d97258e/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
• http://203.26.79.13/filestreamingservice/files/736bdc20-582e-46c5-ba31-d31d3d97258e?P1=1786554979&P2=404&P3=2&P4=Wz8MBj3azHaQT96bWrPJDrneeICehXm3JfhxSVLsGVws1xYWV3z9XmJtSXcMaGNepCDBP67FpA64RtG9kybkjA%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com

Embedded IP addresses

• 20.42.65.94
• 4.230.171.124
• 40.84.97.4
• 20.247.185.124
• 85.210.196.11
• 20.165.94.63
• 135.232.92.97
• 20.184.175.1
• 51.104.15.253
• 203.26.79.13
• 74.179.71.159
• 4.247.188.224
• 135.233.45.223
• 142.250.183.35
• 72.153.5.131
• 52.110.12.22
• 52.110.12.42

More Zbot samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report