MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 345f9fe448241c80424ef0480515898ddbb13369d8a959e6917d3219e73bfca8. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


ZLoader


Vendor detections: 8


Intelligence 8 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 345f9fe448241c80424ef0480515898ddbb13369d8a959e6917d3219e73bfca8
SHA3-384 hash: 3b2bb5512bd26fc3074dba0c03f149d2a3f574781783ec3d909413084555ac85bc34bd464c7db890a9b1db7eb01b9676
SHA1 hash: f11c6ca48196d6b97fbf2be24caf9beada3a7bb0
MD5 hash: 13239b24211dd07a3931012f2b0dc231
humanhash: timing-nuts-zebra-freddie
File name:NF_f5EgkHIBCTvBIBRWJjduxM2nYqVnmkX0yGec7-Kg.bin
Download: download sample
Signature ZLoader
Create hunting rule
File size:452'096 bytes
First seen:2020-08-27 09:18:44 UTC
Last seen:2020-08-27 10:09:23 UTC
File type:DLL dll
MIME type:application/x-dosexec
imphash fb062973b79977fe1a7049eb61ca694d (1 x ZLoader)
ssdeep 12288:auJyDDw5kbHpG73ES0pye3euH3+OzmOnj:auJS10DESQ3e+z/j
Threatray 3 similar samples on MalwareBazaar
TLSH 90A45B396D819F69CC2D54F88FA48BB40C646CC0B62F4DBB228FFA67D976D014C29791
Reporter Anonymous
Tags:ZLoader


Avatar
Anonymous
c2

http://softwareserviceupdater1.com/web/post.php
http://softwareserviceupdater2.com/web/post.php

Intelligence

File Origin
# of uploads :
2
# of downloads :
90
Origin country :
n/a
Vendor Threat Intelligence
Detection:
Zloader
Create hunting rule
Link:
https://www.capesandbox.com/analysis/51714/
Detection(s):
PUA.Win.Downloader.Aiis-6803892-0
Create hunting rule

Result
Verdict:
Clean
Maliciousness:

Behaviour
Sending a UDP request
Result
Threat name:
Unknown
Detection:
malicious
Classification:
n/a
Score:
60 / 100
Link:
https://www.joesandbox.com/analysis/452499
Signature
Machine Learning detection for sample
Multi AV Scanner detection for submitted file
Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)
Behaviour
Behavior Graph:
Download SVG
Detection:
zloader
Create hunting rule
Link:
https://mwdb.cert.pl/sample/345f9fe448241c80424ef0480515898ddbb13369d8a959e6917d3219e73bfca8/
Threat name:
Win32.Trojan.Zeus
Create hunting rule
Status:
Malicious
First seen:
2020-08-27 09:20:07 UTC
AV detection:
17 of 28 (60.71%)
Threat level:
  5/5
Verdict:
malicious
Label(s):
gozi
Create hunting rule
zloader
Create hunting rule
Similar samples:
02846dbf25b333625a0720075fb47da62a946e5b0b4f9e9ba14cef514d576b37
ZLoader
0829886e0ca34a32fa545e0a53d7a2208d963b7b826a14aefde94d9ff4f549e5
ZLoader
c653365657fbf65429ad845d0a0d93106e972aca929739560ff4b4796bd2be08
ZLoader
Result
Malware family:
zloader
Create hunting rule
Score:
  10/10
Tags:
trojan botnet family:zloader
Link:
https://tria.ge/reports/200827-1t8v5mdl9n/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Suspicious use of SetThreadContext
Blacklisted process makes network request
Suspicious use of NtCreateUserProcessOtherParentProcess
Zloader, Terdot, DELoader, ZeusSphinx
Malware Config
C2 Extraction:
Kj��D��U�-O�I?��9?ak���BŖn ���ۑ^R2�W�(���щ��kԀ���/��"�|����N�.�
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Nymaim
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/345f9fe448241c80424ef0480515898ddbb13369d8a959e6917d3219e73bfca8

File information

The table below shows additional information about this malware sample such as delivery method and external references.

  
Delivery method
Distributed via e-mail link
Cape
Cape
https://www.capesandbox.com/analysis/51714/

Comments