MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 bc0b57f04efe4239fcc02f049c97016c653c963de8cbe45bcf9449cd16919f08. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


ZLoader


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: bc0b57f04efe4239fcc02f049c97016c653c963de8cbe45bcf9449cd16919f08
SHA3-384 hash: ec041784815edda8c6a8d9ef443400f40db3fb0b44db82450b83b4b8f5e907ec7830d95cf8c20c4591221ed260586299
SHA1 hash: 1e29f9771c034545e618cdb28e12f1004993f8bf
MD5 hash: a87fab5ef51df54563c1752f4cc5b466
humanhash: tennessee-kilo-jupiter-south
File name:2.dll
Download: download sample
Signature ZLoader
Create hunting rule
File size:462'848 bytes
First seen:2020-04-22 17:52:52 UTC
Last seen:2020-04-22 21:35:13 UTC
File type:DLL dll
MIME type:application/x-dosexec
imphash 5b0a744a028d638abc7f791101016faf (1 x ZLoader)
ssdeep 6144:lNOKA8716v7ae1wR/+0rtDVgfcw3vR2vRz5Datp8E2lv2avF:lsi716eGwIQDGfh3v+z5WtkR26
Threatray 46 similar samples on MalwareBazaar
TLSH B7A4BE007AA1C56EE4605476DE49C9FC1A697C62DF74B493BED0BF0F7BB03E0A225621
Reporter abuse_ch
Tags:dll ZLoader


Avatar
abuse_ch
Malspam campaign sent from SendGrid mailservers, distributign ZLoader:

HELO: o1.lv1le.shared.sendgrid.net
Sending IP: 167.89.100.177
From: Hanna Hers <info@daomaker.com>
Subject: Job
Attachment: Hanna Hers.xls

Other subjects:
application
Hiring

ZLoader payload URLs:
http://wmwifbajxxbcxmucxmlc.com/files/spam22.dll
https://bankss-71.ml/2.dll

Intelligence

File Origin
# of uploads :
2
# of downloads :
98
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Generic.mg.a87fab5ef51df545.27856.UNOFFICIAL
Create hunting rule

PUA.Win.Downloader.Aiis-6803892-0
Create hunting rule

Gathering data
Threat name:
Win32.Trojan.Ursnif
Create hunting rule
Status:
Malicious
First seen:
2020-04-22 18:13:35 UTC
File Type:
PE (Dll)
Extracted files:
1
AV detection:
25 of 31 (80.65%)
Threat level:
  2/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=xqfvp4co7zbdt7gaf4cjzfybnrstzfr55df6iw6psre42furt4ea._file
Verdict:
malicious
Label(s):
zloader
Create hunting rule
gozi
Create hunting rule
Similar samples:
2f2670e8a7845cf300320415c6a16ffc34e662672f16d7cfcf5b911d088516d9
ZLoader
3648fe001994cb9c0a6b510213c268a6bd4761a3a99f3abb2738bf84f06d11cf
ZLoader
4553d627f2509e19e9b84491c08ec9854d785df4f74e900b969c57ccd244c086
ZLoader
a47685b867e6b164a812a05f35b6732c9b81f1fc75b2a7242c18436a9329d247
ZLoader
c44e8d9dba3b4a4cc835b460e69d336347fd3fbfb67621d7cd6e8723976607ce
ZLoader
c55e3938e9c2c9d00235d8ed87a55adc18fa1c6377a9ee0fd6212916c67d0020
ZLoader
e4601ce15ad7bca4617ad033f129a5d507f8e55b979c97a78cf31a6f501cb046
ZLoader
f27183fd7586c6eaca1f6aaed3a7c3c6e52894e23b9656c3953318a85bbbec5d
ZLoader
f2e73ee6ab0ad79e0cd537bd856d9e694851912283bca7fb73eb3fc335528353
ZLoader
fffd7bc61eb5b9759a97699efdf9455b76d9e198b87d75ebdb8a2fa2a4a08306
ZLoader
+ 36 additional samples on MalwareBazaar
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

ZLoader

Excel file xls 447204dc88b3dcfbe13653cf1432b24930f0d8b77841ac21ac151650b1538ec7

ZLoader

DLL dll bc0b57f04efe4239fcc02f049c97016c653c963de8cbe45bcf9449cd16919f08

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/348383/
  
URLhaus
https://urlhaus.abuse.ch/url/348382/
  
Dropped by
MD5 96a23fd971bb3144348b464d673d9836
  
Dropped by
SHA256 447204dc88b3dcfbe13653cf1432b24930f0d8b77841ac21ac151650b1538ec7
  
Delivery method
Distributed via web download

BLint

The following table provides more information about this file using BLint. BLint is a Binary Linter to check the security properties, and capabilities in executables.

Findings
IDTitleSeverity
CHECK_AUTHENTICODEMissing Authenticodehigh
CHECK_NXMissing Non-Executable Memory Protectioncritical
CHECK_PIEMissing Position-Independent Executable (PIE) Protectionhigh
Reviews
IDCapabilitiesEvidence
WIN32_PROCESS_APICan Create Process and ThreadsKERNEL32.dll::CloseHandle
WIN_BASE_APIUses Win Base APIKERNEL32.dll::TerminateProcess
KERNEL32.dll::LoadLibraryA
KERNEL32.dll::GetStartupInfoA
KERNEL32.dll::GetCommandLineA
WIN_BASE_EXEC_APICan Execute other programsKERNEL32.dll::WriteConsoleA
KERNEL32.dll::WriteConsoleW
KERNEL32.dll::SetStdHandle
KERNEL32.dll::GetConsoleCP
KERNEL32.dll::GetConsoleMode
KERNEL32.dll::GetConsoleOutputCP
WIN_BASE_IO_APICan Create FilesKERNEL32.dll::CopyFileA
KERNEL32.dll::CreateDirectoryA
KERNEL32.dll::CreateFileA
KERNEL32.dll::GetWindowsDirectoryA
KERNEL32.dll::GetTempPathA
WIN_SOCK_APIUses Network to send and receive dataWS2_32.dll::WSAWaitForMultipleEvents

Comments