MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 9ce2908edf0994f493926514628054634858340fb73f219c38c013f34dd9a429. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


ZLoader


Vendor detections: 5


Intelligence 5 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 9ce2908edf0994f493926514628054634858340fb73f219c38c013f34dd9a429
SHA3-384 hash: 7ecfaff250d99c8f49018e46f5c2dc687224ec027428085f15b2ce33b76e4fc454d2608290f528f4a0fd9eb38878d68c
SHA1 hash: 125207cb6681e3940f5ac6e1514a70d8a9a467a9
MD5 hash: 270b9afd39da9c6592da446a195bf0ef
humanhash: summer-orange-california-alabama
File name:bbc.dll
Download: download sample
Signature ZLoader
Create hunting rule
File size:484'864 bytes
First seen:2020-06-10 09:43:50 UTC
Last seen:Never
File type:DLL dll
MIME type:application/x-dosexec
imphash 8576f2eda7a30aeed43fccdbadabc440 (16 x Gozi, 10 x ZLoader)
ssdeep 12288:T2s615370KPnJHFlswhjmoUYtIdySZYBk:TZ8Vu8jmotI2S
Threatray 214 similar samples on MalwareBazaar
TLSH CCA4D0E25940B2B0D14BC97E9420B1B681F97C2A7F549180F98B47B735372FAA994FC3
Reporter abuse_ch
Tags:dll geo POL ZLoader


Avatar
abuse_ch
ZLoader payload URL:
https://linesburline.at/3/bbc.dll

Intelligence

File Origin
# of uploads :
1
# of downloads :
67
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
PUA.Win.Downloader.Aiis-6803892-0
Create hunting rule

Gathering data
Threat name:
Win32.Trojan.ZLoader
Create hunting rule
Status:
Malicious
First seen:
2020-06-10 09:45:06 UTC
AV detection:
25 of 31 (80.65%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=ttrjbdw7bgkpje4smukgfacumnefqnapw47sdhbyyaj7gtozuquq._file
Verdict:
malicious
Label(s):
gozi
Create hunting rule
zloader
Create hunting rule
Similar samples:
1fb1ee793145620cc4dd10fe67473b7de1e015a3328f86581ec994738fa9e978
ZLoader
3c774090ba37e891c0268796302378c8340f29c3d5dd1be52395abfd2c126bea
ZLoader
8179cb45ba2d6df0d25f9e1f382c5b9e8b9b703e4404fa19a9002c78418dedea
ZLoader
8761a16b210e215456f4ad4dffeb624ee2b2b3646971860dc5ffb0f8b82658b0
ZLoader
8987107698e6ef8ca9a6804206ea40fcaf9f3869d3e9569e9fbfab2621b69126
ZLoader
8cef73774b9cbc3a63d6212cc1361b9b77c3dfc05d815730e2132535ebadaaa5
ZLoader
aa50192a745ed41728a8f5f4519466c072656ccbbe4a789ef2150ecb2e407789
ZLoader
c28329c132b846b91caaa0c8fc5f8e5b6bf78275772ceee6bea7970bf3de8050
ZLoader
d4678fbba0cf64f91a7844884e17126a2c4095c478d52fe2fa549692b557cca7
ZLoader
e66c91dc125d340382e6f7f19b30d9b956d6a35cf964e3b9bd7a83d499b7cf8d
ZLoader
+ 204 additional samples on MalwareBazaar
Result
Malware family:
zloader
Create hunting rule
Score:
  10/10
Tags:
family:zloader botnet:bot5 campaign:bot5 botnet persistence trojan
Link:
https://tria.ge/reports/201109-6dgl26y4lj/
Behaviour
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Suspicious use of SetThreadContext
Adds Run key to start application
Zloader, Terdot, DELoader, ZeusSphinx
Malware Config
C2 Extraction:
https://militanttra.at/owg.php
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

ZLoader

Excel file xlsm e28b1212adc862b9041201c510b3fabd9df344fa24c74529f3dc8d945aa8df6e

ZLoader

DLL dll 9ce2908edf0994f493926514628054634858340fb73f219c38c013f34dd9a429

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/385322/
  
Dropped by
MD5 2f91acd98787a3ccfae98de192c18c8d
  
Dropped by
SHA256 e28b1212adc862b9041201c510b3fabd9df344fa24c74529f3dc8d945aa8df6e
  
Delivery method
Distributed via web download

Comments