MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 5bbdd845eeb4c298a4edd8f578f4a832086559391ccb2e6e8b50b8c3c10b7fec. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


ZLoader


Vendor detections: 5


Intelligence 5 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 5bbdd845eeb4c298a4edd8f578f4a832086559391ccb2e6e8b50b8c3c10b7fec
SHA3-384 hash: 55a9eb17e16511a9a8e93ff701d12c4cb2241ed68166becfd936c98cf0d0b56aa3ff897338e90379cd3f56f12b89a15c
SHA1 hash: 17f72d2754aac0545cc17e9c0df02207992c5a25
MD5 hash: b153dc3944b6ce544479fd416fbee3f6
humanhash: lithium-king-nevada-wolfram
File name:ijp1
Download: download sample
Signature ZLoader
Create hunting rule
File size:494'592 bytes
First seen:2020-07-01 13:08:07 UTC
Last seen:2020-07-01 14:16:57 UTC
File type:DLL dll
MIME type:application/x-dosexec
imphash 3557ba91f384305b69b2bc24cf61dc34 (2 x ZLoader)
ssdeep 12288:Ma5a4LLsVPBlcw1BCY8dGDAHtb3+Wa+k:MarX4PMw1B/kHtb3A+k
Threatray 128 similar samples on MalwareBazaar
TLSH F9B4BF213BE28035F2BF473A69768A318D6DBC8185349DCB67D2654F063B1C2D269F1B
Reporter JAMESWT_WT

Intelligence

File Origin
# of uploads :
2
# of downloads :
79
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/18245/
Detection(s):
SecuriteInfo.com.Trojan-Banker.DanaBot.30687.UNOFFICIAL
Create hunting rule

PUA.Win.Downloader.Aiis-6803892-0
Create hunting rule

Detection:
zloader
Create hunting rule
Link:
https://mwdb.cert.pl/sample/5bbdd845eeb4c298a4edd8f578f4a832086559391ccb2e6e8b50b8c3c10b7fec/
Threat name:
Win32.Trojan.ZLoader
Create hunting rule
Status:
Malicious
First seen:
2020-07-01 13:10:05 UTC
File Type:
PE (Dll)
AV detection:
20 of 29 (68.97%)
Threat level:
  5/5
Verdict:
malicious
Label(s):
gozi
Create hunting rule
zloader
Create hunting rule
Similar samples:
1db7ceb7b49279e858080a8bd589773871542d86fcca980365fb20eb1fbbc1bf
ZLoader
3bf8fbdad095013493d1b90f5c82880dc57145dfbb54fdf225ded88ba6b1618b
ZLoader
455c21fbac342659cd4b5cc162772117cce60f6b59f04dba0dd4327868a428eb
ZLoader
9c2ce7e11dbd811e2c3e001326f967a0457119b007baebc290e054fad52ea0f0
ZLoader
b715ce2fa69bc8384df1a4137b50bc30e05c0f3f557fe8608635744543b9976d
ZLoader
b7a306bd407cca438202bfb3b92abff60f959418c7fd129487a6510554ff5706
ZLoader
ca755b8915cb1025b4b5748e12cd7d3cbdccbcf90fd5986c911b066043d6d136
ZLoader
cf90fce260606f17508445c8347dc274157bd269c002fd705ab168be96f28538
ZLoader
e7f1b2d2601e9a6427a155a3599614c09c9edaae7eb8f10b81e1f3e117717157
ZLoader
f28dd082013ee7df2f5956c4e8791e863e575aa64071af9a910826bc12d27acb
ZLoader
+ 118 additional samples on MalwareBazaar
Result
Malware family:
zloader
Create hunting rule
Score:
  10/10
Tags:
trojan botnet family:zloader evasion spyware
Link:
https://tria.ge/reports/200701-p2dwjnbvds/
Behaviour
Suspicious use of WriteProcessMemory
Suspicious use of AdjustPrivilegeToken
Suspicious behavior: EnumeratesProcesses
Suspicious use of SetThreadContext
Modifies system certificate store
Blacklisted process makes network request
Zloader, Terdot, DELoader, ZeusSphinx
Suspicious use of NtCreateUserProcessOtherParentProcess
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/18245/

Comments