MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 1db7ceb7b49279e858080a8bd589773871542d86fcca980365fb20eb1fbbc1bf. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


ZLoader


Vendor detections: 7


Intelligence 7 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 1db7ceb7b49279e858080a8bd589773871542d86fcca980365fb20eb1fbbc1bf
SHA3-384 hash: 29bcb3d2102f0b28f86d97b603cba7a967368267151b432e320dc7ed639a0e804123558a19e674dd1c1b29c8971c5b36
SHA1 hash: 9820fde0873ec93779f619973544d047a8bd8afb
MD5 hash: f5e5d82309619334c508544cd9a20e63
humanhash: indigo-seven-cat-mobile
File name:PSCavX9M
Download: download sample
Signature ZLoader
Create hunting rule
File size:479'744 bytes
First seen:2020-07-08 13:22:17 UTC
Last seen:Never
File type:DLL dll
MIME type:application/x-dosexec
imphash 1dbe8abb79ccf0f8ed080b1763a346f4 (1 x ZLoader)
ssdeep 12288:g335rC3qMXh0RJVPSQNmD3vurmCrGl+Omk0oQY+LJQzvD8c:apzPkOmCrGM9oHAJy8
Threatray 143 similar samples on MalwareBazaar
TLSH 22A4E1D26E86A07BCDEE6C344432C8B1941C7D22153DDDD7FBC46BBB9A360508279C6A
Reporter JAMESWT_WT
Tags:dll ZLoader


Avatar
JAMESWT_WT
IE agent

Intelligence

File Origin
# of uploads :
1
# of downloads :
99
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/23125/
Detection(s):
PUA.Win.Downloader.Aiis-6803892-0
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Launching a process
Detection:
zloader
Create hunting rule
Link:
https://mwdb.cert.pl/sample/1db7ceb7b49279e858080a8bd589773871542d86fcca980365fb20eb1fbbc1bf/
Threat name:
Win32.Trojan.ZLoader
Create hunting rule
Status:
Malicious
First seen:
2020-07-08 13:23:04 UTC
File Type:
PE (Dll)
Extracted files:
1
AV detection:
19 of 27 (70.37%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=dw345n5usj46qwaibkf5lclxhbyvilmg7tfjqa3f7mqowh53yg7q._file
Verdict:
malicious
Label(s):
gozi
Create hunting rule
zloader
Create hunting rule
Similar samples:
3326d4607b164078735ee55313992c18e83e6b87b75faf350b8c61a99eb2b659
ZLoader
3bf8fbdad095013493d1b90f5c82880dc57145dfbb54fdf225ded88ba6b1618b
ZLoader
3dd800b875aa0ef2fa0923babdd4b162555a1c3ff3c58e9291d45fff82389816
ZLoader
5bbdd845eeb4c298a4edd8f578f4a832086559391ccb2e6e8b50b8c3c10b7fec
ZLoader
9c2ce7e11dbd811e2c3e001326f967a0457119b007baebc290e054fad52ea0f0
ZLoader
b715ce2fa69bc8384df1a4137b50bc30e05c0f3f557fe8608635744543b9976d
ZLoader
b8a7600b813dbd100629f8353a30592f21163319ab6229b1b46c2693483b2ae1
ZLoader
ca755b8915cb1025b4b5748e12cd7d3cbdccbcf90fd5986c911b066043d6d136
ZLoader
cf90fce260606f17508445c8347dc274157bd269c002fd705ab168be96f28538
ZLoader
f28dd082013ee7df2f5956c4e8791e863e575aa64071af9a910826bc12d27acb
ZLoader
+ 133 additional samples on MalwareBazaar
Result
Malware family:
zloader
Create hunting rule
Score:
  10/10
Tags:
trojan botnet family:zloader evasion spyware
Link:
https://tria.ge/reports/200708-x8yy9dqx92/
Behaviour
Suspicious use of WriteProcessMemory
Suspicious use of AdjustPrivilegeToken
Suspicious behavior: EnumeratesProcesses
Suspicious use of SetThreadContext
Modifies system certificate store
Blacklisted process makes network request
Zloader, Terdot, DELoader, ZeusSphinx
Suspicious use of NtCreateUserProcessOtherParentProcess
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

ZLoader

DLL dll 1db7ceb7b49279e858080a8bd589773871542d86fcca980365fb20eb1fbbc1bf

(this sample)

  
Link
https://dayton.store/wp-index.php
Cape
Cape
https://www.capesandbox.com/analysis/23125/
  
URLhaus
https://urlhaus.abuse.ch/url/408935/
  
Delivery method
Distributed via web download
  
URLhaus
https://urlhaus.abuse.ch/url/409011/

Comments