MalwareBazaar Database
You are currently viewing the MalwareBazaar entry for SHA256 1ea43f2b7589f266a7574e987b3a5c80634060fc2d1fe0eae77410c76dea326c. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.
Database Entry
ZLoader
Vendor detections: 4
| SHA256 hash: | 1ea43f2b7589f266a7574e987b3a5c80634060fc2d1fe0eae77410c76dea326c |
|---|---|
| SHA3-384 hash: | 537e3bf9761400339e9046edc2d67640df62003f35645411dcf4c609901efc7d3622b631ed6b65af5a8e0bf062cb60fd |
| SHA1 hash: | 9364679fa1142dd15759fc22ed3d15b65ab447b2 |
| MD5 hash: | 8688f0253256e5c6cfc27a3801e6077b |
| humanhash: | single-robin-may-nitrogen |
| File name: | ssf.dll |
| Download: | download sample |
| Signature | ZLoader |
| File size: | 448'512 bytes |
| First seen: | 2020-04-02 17:46:35 UTC |
| Last seen: | Never |
| File type: |  dll |
| MIME type: | application/x-dosexec |
| imphash | 9d0375e0528c027b2092b732fbef39b5 (1 x ZLoader) |
| ssdeep | 12288:/4B8qIBi/bdOcteKcEAUg+tAiYBNnyPEfYIzUY:gBnIBiTxzLADiSnyPlz |
| Threatray | 36 similar samples on MalwareBazaar |
| TLSH | 9594E10077F2D436E44646778869DB6609AF7CA14F7588C3B3C49A9FB9720C0573AB27 |
| Reporter |  abuse_ch |
| Tags: | dll ZLoader |
abuse_ch
Malspam campaign, likely sent through compromised email accounts, distributing ZLoader:Helo: smtpauth-dc2.online.net
Sending IP: 62.210.16.40
From: TESCO (POLSKA) SP Z O O <sally@saint-bonnet.net>
Subject: TESCO - kupon rabatowy NR 55163177
Attachment: Rechnung_13.xls
ZLoader payload delivery URL:
https://eetownvulgar.xyz/3/ssf.dll
Related:
pranksduck.xyz
ZLoader C2s:
https://representis.xyz/noagate.php
https://representis.icu/noagate.php
Intelligence
File Origin
# of uploads :
1
# of downloads :
97
Origin country :
n/a
Vendor Threat Intelligence
Gathering data
Threat name:
Win32.Trojan.Cridex
Status:
Malicious
First seen:
2020-04-02 18:35:28 UTC
File Type:
PE (Dll)
AV detection:
22 of 31 (70.97%)
Threat level:
5/5
Detection(s):
Malicious file
Verdict:
malicious
Label(s):
gozi
Similar samples:
+ 26 additional samples on MalwareBazaar
Please note that we are no longer able to provide a coverage score for Virus Total.
File information
The table below shows additional information about this malware sample such as delivery method and external references.
Malspam
xls Delivery method
Distributed via e-mail link
BLint
The following table provides more information about this file using BLint. BLint is a Binary Linter to check the security properties, and capabilities in executables.
Findings
| ID | Title | Severity |
|---|---|---|
| CHECK_AUTHENTICODE | Missing Authenticode | high |
| CHECK_DLL_CHARACTERISTICS | Missing dll Security Characteristics (HIGH_ENTROPY_VA) | high |
Reviews
| ID | Capabilities | Evidence |
|---|---|---|
| WIN32_PROCESS_API | Can Create Process and Threads | KERNEL32.dll::CloseHandle |
| WIN_BASE_API | Uses Win Base API | KERNEL32.dll::TerminateProcess KERNEL32.dll::LoadLibraryExW KERNEL32.dll::GetStartupInfoW KERNEL32.dll::GetCommandLineA |
| WIN_BASE_EXEC_API | Can Execute other programs | KERNEL32.dll::WriteConsoleW KERNEL32.dll::SetStdHandle KERNEL32.dll::GetConsoleCP KERNEL32.dll::GetConsoleMode |
| WIN_BASE_IO_API | Can Create Files | KERNEL32.dll::CreateFileW |
Comments
Login required
You need to login to in order to write a comment. Login with your abuse.ch account.