MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 1267b822cde1edabfc063458232a5ed9ea03652416de96b8d12ecb1058c86e23. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


ZLoader


Vendor detections: 4


Intelligence 4 IOCs YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 1267b822cde1edabfc063458232a5ed9ea03652416de96b8d12ecb1058c86e23
SHA3-384 hash: 78f0f912db3499ebaa44801b4fba441e8e97694e3d7205b1df654d12bd45fd363e9d095aac2ac4d529abc24cd465b8d2
SHA1 hash: 330545c5092c3a991bf1612abc228117f8a64b8f
MD5 hash: d97340776c76a6a02c7195bdc0a856b7
humanhash: maryland-blue-foxtrot-wolfram
File name:t.dll
Download: download sample
Signature ZLoader
Create hunting rule
File size:953'856 bytes
First seen:2020-05-26 16:53:08 UTC
Last seen:2020-05-26 18:08:23 UTC
File type:DLL dll
MIME type:application/x-dosexec
imphash ffd64dceaa87596634ffa2c46c621680 (1 x ZLoader)
ssdeep 24576:o/5I+Q1GfRABKiqUV/PV9wcfQizRlQowANibE:cq+4GL3yHNfPwANx
Threatray 41 similar samples on MalwareBazaar
TLSH D1159D00B751C035F5B629F86D6986BE592D3EA14B2090CBB3C06FEF563A5D4AE3071B
Reporter threathive
Tags:ZLoader

Intelligence

File Origin
# of uploads :
2
# of downloads :
80
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
PUA.Win.Downloader.Aiis-6803892-0
Create hunting rule

Gathering data
Threat name:
Win32.Trojan.Cridex
Create hunting rule
Status:
Malicious
First seen:
2020-05-26 17:35:40 UTC
File Type:
PE (Dll)
Extracted files:
1
AV detection:
16 of 30 (53.33%)
Threat level:
  2/5
Verdict:
malicious
Label(s):
zloader
Create hunting rule
gozi
Create hunting rule
Similar samples:
385be4267e9aaadfb82815d54dde7fccbd0d1b843aa3c4062ef752a9378ae02e
ZLoader
39599008089755aa7cccb534b2c94ccb537f266018bb67ae3ed4b9f51c0a40b9
ZLoader
6593fa326b8eb0b737a17889c50c539ac45f2f9215fdab50ffa62df1be7ec2d1
ZLoader
692c58e28e0f0346adfbad2356dd8495ec8f07718ee40db171b50e8870526f96
ZLoader
7d5ef8e6c5738ebc13718eee67f0b6cc354f3e28b135e4a378f69d57043299b8
ZLoader
abe31666e7b408ed139ba7452f70d3f633b7cc7ce0de9de8b8c6489f47a34df8
ZLoader
b8f848f137a23fe046b4701a67d07c8e7e1a8fdb066f318424caede7a1e69530
ZLoader
cc32eb0fb5c35376f69a3d6b81fdb339309d06d80a2cffa2604e21012ac33c18
ZLoader
ccf1e6416673f50f016cfa1658e9dd29793195b9bc701fedc1218d122faeb6b2
ZLoader
e4bffaffaa1de9c8d8fcd49caf92c585277145c9a1d15f5d7a60e20ed1334e22
ZLoader
+ 31 additional samples on MalwareBazaar
Result
Malware family:
zloader
Create hunting rule
Score:
  10/10
Tags:
family:zloader botnet:miguel campaign:26/05 botnet trojan
Link:
https://tria.ge/reports/201109-432c3hqcsa/
Behaviour
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Suspicious use of SetThreadContext
Blacklisted process makes network request
Zloader, Terdot, DELoader, ZeusSphinx
Malware Config
C2 Extraction:
https://cripuntisispoi.tk/wp-parser.php
https://unesrafho.cf/wp-parser.php
http://sannyjewelry.ir/wp-parser.php
http://printgenerator.sundaytimes.lk/wp-parser.php
Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:win_zloader_auto
Create hunting rule
Author:Felix Bilstein - yara-signator at cocacoding dot com
Description:autogenerated rule brought to you by yara-signator

File information

The table below shows additional information about this malware sample such as delivery method and external references.

  
Link
https://pensstomductchatlihet.tk/ew/t.dll

Comments