MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 4fb5e1b5eaa6a8f4ff3e80429adaa9f5af1dded814c724a7839f25636530d0e3. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


ZLoader


Vendor detections: 10


Intelligence 10 IOCs YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 4fb5e1b5eaa6a8f4ff3e80429adaa9f5af1dded814c724a7839f25636530d0e3
SHA3-384 hash: 4a323d3083270f1114f39cef45824c4833605a2f48c298b74898ce735c1c6e1ec96d39f726ff97dbbdb9397e48ce267a
SHA1 hash: 3ee769477a72b6dbc39cfed759e6f58d16a96151
MD5 hash: d807f97e41c73e54984ebe5a5228be7a
humanhash: sad-carbon-two-eighteen
File name:202.dll
Download: download sample
Signature ZLoader
Create hunting rule
File size:396'632 bytes
First seen:2020-07-20 20:27:27 UTC
Last seen:2020-07-20 21:52:29 UTC
File type:DLL dll
MIME type:application/x-dosexec
imphash 45218ee31416a5baacc2d3baa37fa7df (1 x ZLoader)
ssdeep 6144:lOqGO7ALX5XWepJpsQ2zPjA052Dj7tl9AFum4jHWv5IrhPqsE9:lB57eXh5AT52Dj7t/AFufEh
Threatray 87 similar samples on MalwareBazaar
TLSH D684F1E0C2075F87DCB691F264E018B67AC1CE935A1C4098F1589FDEE8DD5B362A89D3
Reporter threathive
Tags:ZLoader

Intelligence

File Origin
# of uploads :
2
# of downloads :
88
Origin country :
n/a
Vendor Threat Intelligence
Detection:
Zloader
Create hunting rule
Link:
https://www.capesandbox.com/analysis/29424/
Detection(s):
SecuriteInfo.com.Mal.EncPk-APV.24639.28750.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Launching a process
Creating a file in the %AppData% subdirectories
Running batch commands
Creating a process with a hidden window
Launching the process to interact with network services
Launching the default Windows debugger (dwwin.exe)
Enabling autorun with the standard Software\Microsoft\Windows\CurrentVersion\Run registry branch
Unauthorized injection to a system process
Result
Threat name:
Unknown
Detection:
malicious
Classification:
n/a
Score:
52 / 100
Link:
https://www.joesandbox.com/analysis/392060
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 248369 Sample: 202.dll Startdate: 21/07/2020 Architecture: WINDOWS Score: 52 10 Multi AV Scanner detection for submitted file 2->10 12 Machine Learning detection for sample 2->12 6 loaddll32.exe 1 2->6         started        process3 process4 8 WerFault.exe 9 10 6->8         started       
Detection:
zloader
Create hunting rule
Link:
https://mwdb.cert.pl/sample/4fb5e1b5eaa6a8f4ff3e80429adaa9f5af1dded814c724a7839f25636530d0e3/
Threat name:
Win32.Downloader.ZLoader
Create hunting rule
Status:
Malicious
First seen:
2020-07-20 20:29:04 UTC
AV detection:
22 of 29 (75.86%)
Threat level:
  3/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=j626dnpku2upj7z6qbbjvwvj6wxr3xwyctdsjj4dt4swgzjq2drq._file
Verdict:
malicious
Label(s):
zloader
Create hunting rule
Similar samples:
280fedf6fd7e0964222ac9b21bcc289c222c7ea91d7bad6350741bdf8c1f0938
ZLoader
29c222f82d9db373ee755ac832c22540afb8f8708eafe8e96266a02b80759066
ZLoader
42bb5eae534eb2cea979c300b797a65febf291b28aea0b9d8bbea7d0a41bffa2
ZLoader
67b46301815d5ba32f90af114a459810902ba6d97a75821c8455b8103073b499
ZLoader
a51d5fe8c5f9ea9c4af866b7b6669845433934e4b4528995a3ac1702e7002c0e
ZLoader
a5e798492ba6892a57c79c635679563eceacb6d1efcc38f5dfc0232518861ca8
ZLoader
a81932797aa7e6324dc3390718163035c75620e6a0fa29c146c13c33b654a283
ZLoader
a97b7b2353dc9012b6cb914f6665d0e93f557859411d2e08b942316c09d7b07f
ZLoader
c8b452572f409a7d0752734334371c900983c8e15cbf8299bda7fe7a33a1047e
ZLoader
df2524f89b7247e931a13644d2c00bbc94095eb8e4755a9db2421bd46f365f7c
ZLoader
+ 77 additional samples on MalwareBazaar
Result
Malware family:
zloader
Create hunting rule
Score:
  10/10
Tags:
persistence spyware trojan botnet family:zloader
Link:
https://tria.ge/reports/200720-5x3nxkcx7j/
Behaviour
Suspicious behavior: EnumeratesProcesses
Modifies system certificate store
Runs net.exe
Discovers systems in the same network
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Gathers network information
Suspicious use of SetThreadContext
Modifies service
Adds Run key to start application
Reads user/profile data of web browsers
Blacklisted process makes network request
Zloader, Terdot, DELoader, ZeusSphinx
Malware Config
C2 Extraction:
https://dsdjfhdsufudhjas.name/gate.php
https://dsdjfhd9ddksaas.com/gate.php
https://dsdjfhdsufudhjas.pw/gate.php
https://dsdjfhd9ddksaas.ru/gate.php
https://dsdjfhdsufudhjas.su/gate.php
https://kdsadisadijdsasm2.com/gate.php
https://dsdjfhdsufudhjas.net/gate.php
https://dsdjfhd9ddksaas.eu/gate.php
03d5ae30a0bd934a23b6a7f0756aa504
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Unknown
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/4fb5e1b5eaa6a8f4ff3e80429adaa9f5af1dded814c724a7839f25636530d0e3

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:win_zloader_auto
Create hunting rule
Author:Felix Bilstein - yara-signator at cocacoding dot com
Description:autogenerated rule brought to you by yara-signator

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

ZLoader

DLL dll 4fb5e1b5eaa6a8f4ff3e80429adaa9f5af1dded814c724a7839f25636530d0e3

(this sample)

  
Link
https://neroyaki.site/202.dll
Cape
Cape
https://www.capesandbox.com/analysis/29424/
  
URLhaus
https://urlhaus.abuse.ch/url/415711/
  
Delivery method
Distributed via web download

Comments