MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 2f93f6e6c2f2c3a9e9e62c976fde8668fe6c99aaba02809217ad5c2e1ac0227a. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


ZLoader


Vendor detections: 5


Intelligence 5 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 2f93f6e6c2f2c3a9e9e62c976fde8668fe6c99aaba02809217ad5c2e1ac0227a
SHA3-384 hash: 1ab2d555e93ede4a1af694b0b2315cf6ba22d9bdee4818f267ae3cd9220b5cad77c41d68a84a511b7af1b28cdc39147b
SHA1 hash: 583461aa5b6a39c5a1f969118e1191f70fdf09fe
MD5 hash: bc58fbed7d71bf28acea73add0503c02
humanhash: winner-venus-asparagus-florida
File name:rbs.dll
Download: download sample
Signature ZLoader
Create hunting rule
File size:662'528 bytes
First seen:2020-06-10 15:45:46 UTC
Last seen:Never
File type:DLL dll
MIME type:application/x-dosexec
imphash 9b6633e85c68c0277bf2da68b640f509 (15 x Gozi, 2 x ZLoader)
ssdeep 12288:yFyxomntU5cu7cGDD+pJ7ZwwF3E+pgIbRzFyWBaobi/jDnQAVVR/VUR:yFyxomntU5dapcuxpgWHmPjVR/VU
Threatray 70 similar samples on MalwareBazaar
TLSH BBE4BE05B791D038F9B726F98EBEA1B8943D7DA05B2494CB23C41AEF55246F1AC30727
Reporter JAMESWT_WT
Tags:ZLoader

Intelligence

File Origin
# of uploads :
1
# of downloads :
73
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
PUA.Win.Downloader.Aiis-6803892-0
Create hunting rule

Gathering data
Threat name:
Win32.Trojan.ZLoader
Create hunting rule
Status:
Malicious
First seen:
2020-06-10 15:44:06 UTC
File Type:
PE (Dll)
Extracted files:
1
AV detection:
23 of 31 (74.19%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=f6j7nzwc6lb2t2pgfslw7xugnd7gzgnkxibibeqxvvoc4gwaej5a._file
Verdict:
malicious
Label(s):
gozi
Create hunting rule
Similar samples:
01173873e92d5dd520fa88e8587ec05c92e3f36f6136b8ff50fd1b0b13df1401
ZLoader
106e4f35cac5e72d0ff42e92e5b0fe1ebdb5cf31aa9ae9fa18073c924ec0e635
ZLoader
16e5ddfcf4902431e2566a2a04424e1b0236d2958647bd57b7075be0013c3de1
ZLoader
1b4e008beb2b395e53648c9a246ecafcb3df0543c5236a40cdb976a2007bbf97
ZLoader
26625bd8081701ab5a248b4f6e726cd5ef07b43c817e5499b766f89980532952
ZLoader
8564809c3aaa8e94463ec9ac0fb4e51c52c5e57a25ea09a997258184c656389a
ZLoader
8914aa5433f7284881402dc27336d96baa74c6e7ce16f28531bb917c1dfa3e0f
ZLoader
b580afe615e4e13cffbcd130379521dcfdd89c2b36a0ab1d4b5fef98814b141e
ZLoader
bd0d1a5cc00640c72a4581df4d4c86caa627b07f1b8931920b9742855db35851
ZLoader
f54d245e7fdffb4b6886f2e68c401c4afde2637359aa5f0fb2b1a1c2eadde6c3
ZLoader
+ 60 additional samples on MalwareBazaar
Result
Malware family:
zloader
Create hunting rule
Score:
  10/10
Tags:
family:zloader botnet:bot5 campaign:bot5 botnet trojan
Link:
https://tria.ge/reports/201109-rweb1lsynn/
Behaviour
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Suspicious use of SetThreadContext
Zloader, Terdot, DELoader, ZeusSphinx
Malware Config
C2 Extraction:
https://militanttra.at/owg.php
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Comments