MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 e3bcf059f0ad7b1c92462646e135623d3ce75addcd6a0d207b78e2fbfb6dac2d. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

ZLoader

Vendor detections: 5

Intelligence 5 IOCs YARA File information Comments

SHA256 hash:	e3bcf059f0ad7b1c92462646e135623d3ce75addcd6a0d207b78e2fbfb6dac2d
SHA3-384 hash:	fd4ec213f9b44844d5eacc3a4c4ed4207992c2d9ca8cea6b60dc72d03da446da5212e7f4b076e4d7146cbe9d396970e8
SHA1 hash:	c43c113ad5fd90a04f96b2188078ce372fd84859
MD5 hash:	f2f6fef7797832e67d7b0d0c3bf5b671
humanhash:	social-enemy-summer-august
File name:	zuygy.dll
Download:	download sample
Signature	ZLoader Create hunting rule
File size:	883'712 bytes
First seen:	2020-04-03 19:47:42 UTC
Last seen:	2020-04-03 20:31:30 UTC
File type:	dll
MIME type:	application/x-dosexec
imphash	f3576d5c33b0c8f2b43921e1a037b4d7 (1 x ZLoader)
ssdeep	6144:KBsYGB/uEpZ5WFFwGqpSwQLrWU6iQF45AdNcUqyARLH121lqKdckQswh/:KB9gIFwGqEwQLqx4QqdZol2Z
Threatray	39 similar samples on MalwareBazaar
TLSH	FF15D55BAE4394F3E3312A3FA6821A0255147D85E4E1198F767DFF1D6E78EA26C01EC0
Reporter	Racco42
Tags:	dll ZLoader

Intelligence

File Origin

# of uploads :

# of downloads :

Origin country :

n/a

Vendor Threat Intelligence

Detection:

Zloader

Link:

https://www.capesandbox.com/analysis/318/

Detection(s):

SecuriteInfo.com.Troj.Mdrop-JBN.16966.16566.UNOFFICIAL

Gathering data

Threat name:

Win32.Trojan.Zbot

Status:

Malicious

First seen:

2020-04-03 08:51:08 UTC

File Type:

PE (Dll)

Extracted files:

AV detection:

25 of 31 (80.65%)

Threat level:

2/5

Detection(s):

Malicious file

Link:

https://check.spamhaus.org/check/?searchterm=4o6pawpqvv5rzesgezdocnlchu6ooww5zvva2id3pdrpx63nvqwq._file

Verdict:

malicious

Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

ZLoader

vbs 3920ecf9f7dc8f7fe34721ff41f5955b2ed0943eae2031ff602ae92bc6f3b7c5

ZLoader

DLL dll e3bcf059f0ad7b1c92462646e135623d3ce75addcd6a0d207b78e2fbfb6dac2d

(this sample)

Delivery method

Other

Dropped by

SHA256 3920ecf9f7dc8f7fe34721ff41f5955b2ed0943eae2031ff602ae92bc6f3b7c5

Cape

https://www.capesandbox.com/analysis/318/

BLint

The following table provides more information about this file using BLint. BLint is a Binary Linter to check the security properties, and capabilities in executables.

Findings

ID	Title	Severity
CHECK_AUTHENTICODE	Missing Authenticode	high
CHECK_NX	Missing Non-Executable Memory Protection	critical
CHECK_PIE	Missing Position-Independent Executable (PIE) Protection	high

Reviews

ID	Capabilities	Evidence
AUTH_API	Manipulates User Authorization	advapi32.dll::LookupSecurityDescriptorPartsA
MULTIMEDIA_API	Can Play Multimedia	ole32.dll::DllGetClassObject winmm.dll::mciGetYieldProc winmm.dll::midiOutGetErrorTextW winmm.dll::mixerGetID
PRINT_SPOOLER_API	Manipulates Printer Drivers	winspool.drv::DevQueryPrint
WIN_BASE_API	Uses Win Base API	kernel32.dll::LoadLibraryA shell32.dll::SHGetDiskFreeSpaceExW
WIN_BASE_EXEC_API	Can Execute other programs	kernel32.dll::GetConsoleCP imagehlp.dll::SymUnloadModule
WIN_BASE_IO_API	Can Create Files	version.dll::GetFileVersionInfoW

Comments

Login required

You need to login to in order to write a comment. Login with your abuse.ch account.

No comments found for this malware sample