MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 0b8585bcbc29e0a8f25118bc695cade9fed7a4676f3ea471bf08c869d8c85b63. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

ZLoader

Vendor detections: 4

Intelligence 4 IOCs YARA File information Comments

SHA256 hash:	0b8585bcbc29e0a8f25118bc695cade9fed7a4676f3ea471bf08c869d8c85b63
SHA3-384 hash:	35ae0fdea2ef9118f557f0fe8c876dffaf89d2daf2d84a2cd96e3b498ab1b7cd8ee60578b2367ffd9add3dc987692ebf
SHA1 hash:	f0052900fcb905021c79abf0bd3ab4eba09fb5ce
MD5 hash:	329dc85d3b5bc75e478343bb9451fd33
humanhash:	jig-lamp-jupiter-emma
File name:	april14.dll
Download:	download sample
Signature	ZLoader Create hunting rule
File size:	552'448 bytes
First seen:	2020-04-14 14:08:45 UTC
Last seen:	2020-04-14 17:37:48 UTC
File type:	dll
MIME type:	application/x-dosexec
imphash	f9d209a7de28d9fcb8e5cc722e0bf45a (2 x ZLoader, 2 x Gozi)
ssdeep	12288:2fgs/ArU7RabXDUMr6xziFHPSMI0VI/+m3Ian:2fZYcan/JzxOD4an
Threatray	37 similar samples on MalwareBazaar
TLSH	04C4AD603A86C075E04A01B1CB79E6B46078BC784F5119DB73E4AE5FB2F36C5723AE52
Reporter	abuse_ch
Tags:	dll ZLoader

abuse_ch

ZLoader malspam:

HELO: xvfrqvdb.outbound-mail.sendgrid.net
Sending IP: 168.245.72.219
From: Robert Johnson <35@pilottraining.ca>
Subject: Job Application
Attachment: Robert Johnson Resume.xls

ZLoader payload URL:
http://wmwifbajxxbcxmucxmlc.com/files/april14.dll

Intelligence

File Origin

# of uploads :

# of downloads :

Origin country :

n/a

Vendor Threat Intelligence

Detection(s):

SecuriteInfo.com.Generic.mg.329dc85d3b5bc75e.20354.UNOFFICIAL

PUA.Win.Downloader.Aiis-6803892-0

Gathering data

Threat name:

Win32.Trojan.Kryptik

Status:

Malicious

First seen:

2020-04-14 14:35:35 UTC

File Type:

PE (Dll)

Extracted files:

AV detection:

22 of 31 (70.97%)

Threat level:

5/5

Detection(s):

Malicious file

Link:

https://check.spamhaus.org/check/?searchterm=bocylpf4fhqkr4srdc6gsxfn5h7npjdhn47ki4n7bdegtwgilnrq._file

Verdict:

malicious

Label(s):

zloader

gozi

Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

ZLoader

xls 0090e624ffc2118731d55fc87660b78977b3f8c975006b1e58df03e8a134cc4f

ZLoader

DLL dll 0b8585bcbc29e0a8f25118bc695cade9fed7a4676f3ea471bf08c869d8c85b63

(this sample)

URLhaus

https://urlhaus.abuse.ch/url/340197/

Dropped by

MD5 449eb553822fa8137aa795cd03182a3f

Dropped by

SHA256 0090e624ffc2118731d55fc87660b78977b3f8c975006b1e58df03e8a134cc4f

Delivery method

Distributed via web download

BLint

The following table provides more information about this file using BLint. BLint is a Binary Linter to check the security properties, and capabilities in executables.

Findings

ID	Title	Severity
CHECK_AUTHENTICODE	Missing Authenticode	high
CHECK_DLL_CHARACTERISTICS	Missing dll Security Characteristics (HIGH_ENTROPY_VA)	high

Reviews

ID	Capabilities	Evidence
COM_BASE_API	Can Download & Execute components	ole32.dll::CoCreateInstance
WIN32_PROCESS_API	Can Create Process and Threads	KERNEL32.dll::CloseHandle
WIN_BASE_API	Uses Win Base API	KERNEL32.dll::TerminateProcess KERNEL32.dll::LoadLibraryExW KERNEL32.dll::GetStartupInfoW KERNEL32.dll::GetCommandLineA
WIN_BASE_EXEC_API	Can Execute other programs	KERNEL32.dll::WriteConsoleW KERNEL32.dll::ReadConsoleW KERNEL32.dll::SetStdHandle KERNEL32.dll::GetConsoleCP KERNEL32.dll::GetConsoleMode
WIN_BASE_IO_API	Can Create Files	KERNEL32.dll::CreateFileW

Comments

Login required

You need to login to in order to write a comment. Login with your abuse.ch account.

No comments found for this malware sample