MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 0eb287052bad63c28c2ddb52722b87a40331cb41806e494cd4d83c8b409c6178. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


ZLoader


Vendor detections: 5


Intelligence 5 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 0eb287052bad63c28c2ddb52722b87a40331cb41806e494cd4d83c8b409c6178
SHA3-384 hash: c337d39b2ad8d2c6903cd3c02aaf70e884527f02ace9e91d0a82c1883e3cc01239c276465ac12a4c23bf29838aef85f7
SHA1 hash: e8980445b432b6bd8d73c6cc5c1353966b37d114
MD5 hash: b5009fa4759ad978c438232d613c8ba0
humanhash: bluebird-gee-georgia-low
File name:dws.dll
Download: download sample
Signature ZLoader
Create hunting rule
File size:679'936 bytes
First seen:2020-06-12 08:38:58 UTC
Last seen:2020-06-12 09:44:46 UTC
File type:DLL dll
MIME type:application/x-dosexec
imphash f9b9221f67b0fccc2e9a35bec3a33d30 (5 x Gozi, 3 x ZLoader)
ssdeep 12288:bHMY2akXvNE8jI0pNtG/yin1bb6H9UoyLRAq6BdnbbXO+uVBzSeiTzF:gy6NE88K7itR6H9xWRPYOBzqX
Threatray 123 similar samples on MalwareBazaar
TLSH DAE48D1277B04024F6BB1BB854FB11659A7E7ED09738C5CB43C022EA4AB7AD0AE34757
Reporter JAMESWT_WT
Tags:ZLoader

Intelligence

File Origin
# of uploads :
2
# of downloads :
77
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/10005/
Detection(s):
PUA.Win.Packer.PrivateExeProte-11
Create hunting rule

PUA.Win.Downloader.Aiis-6803892-0
Create hunting rule

Gathering data
Threat name:
Win32.Worm.Cridex
Create hunting rule
Status:
Malicious
First seen:
2020-06-12 08:38:09 UTC
File Type:
PE (Dll)
Extracted files:
1
AV detection:
21 of 28 (75.00%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=b2ziobjlvvr4fdbn3njhek4huqbtds2bqbxestgu3a6iwqe4mf4a._file
Verdict:
malicious
Label(s):
gozi
Create hunting rule
zloader
Create hunting rule
Similar samples:
244bd22b299305418f66c5a6239c70bdc5eced7c0464210feaac591301241cd5
ZLoader
73abd3856eaa081063998925894e6a335b1ef4a79434eddd312ef15cccf2360e
ZLoader
8179cb45ba2d6df0d25f9e1f382c5b9e8b9b703e4404fa19a9002c78418dedea
ZLoader
998014de6243f054fde2ba82c0c094313b59bc040bd5940a47163e383760af9b
ZLoader
9ce2908edf0994f493926514628054634858340fb73f219c38c013f34dd9a429
ZLoader
a07a359c59be4c8213ab755da287c7bf2da497415185e1c434b55cad6af544de
ZLoader
a9b7021255f515544819e0d0d7fc650a7c2f373efbd6582761679f2ae6ce05cc
ZLoader
ccdee30c90b6f380a5596715bd42f7694814c859ca9b3da00fe9918b22ffd715
ZLoader
e283e238a6df23efffad6f388ccc2de0b1e6f072fd6fb4eaed8065aa1d5a5aec
ZLoader
fd8c062ff0b80d0560a5c239f9a035e821053ff0ee1e3907c88bb4a4b04fee30
ZLoader
+ 113 additional samples on MalwareBazaar
Result
Malware family:
zloader
Create hunting rule
Score:
  10/10
Tags:
family:zloader botnet:bot5 campaign:bot5 botnet persistence trojan
Link:
https://tria.ge/reports/201109-b6wl3kgmsa/
Behaviour
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Suspicious use of SetThreadContext
Adds Run key to start application
Zloader, Terdot, DELoader, ZeusSphinx
Malware Config
C2 Extraction:
https://militanttra.at/owg.php
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/10005/

Comments