MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 f2e73ee6ab0ad79e0cd537bd856d9e694851912283bca7fb73eb3fc335528353. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


ZLoader


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: f2e73ee6ab0ad79e0cd537bd856d9e694851912283bca7fb73eb3fc335528353
SHA3-384 hash: 5376b259a1e77454aad3e4b7b54a26bc2cb1980591e39f48687d0d76b210c44cb6f10f9ad3ef97a90aafd8ea4afd1729
SHA1 hash: 19d51e298f43c00af96861f1f6ffaf39132a187d
MD5 hash: 1c48729a2cfa0b985e36818822858436
humanhash: charlie-four-sixteen-stairway
File name:a.dll
Download: download sample
Signature ZLoader
Create hunting rule
File size:463'360 bytes
First seen:2020-04-17 16:25:48 UTC
Last seen:2020-04-17 16:40:51 UTC
File type:DLL dll
MIME type:application/x-dosexec
imphash 15b640fcb05bb05afbc2b524444e30a6 (1 x ZLoader)
ssdeep 6144:Y+IE4Q4Cz+Fq+al/2mtGyt+9YtPc5wnx8D9lC+uQcorwgy82+5yRGAE78:BtyFq1l/lEU+9YK5IGjbuQUgy8j2EI
Threatray 43 similar samples on MalwareBazaar
TLSH 9AA4F12177DAC075E2A36479ED2EF9624D09BCC00E246CE7F648E94A5D7F2E14A34C27
Reporter abuse_ch
Tags:dll ZLoader

Intelligence

File Origin
# of uploads :
2
# of downloads :
84
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Generic.mg.1c48729a2cfa0b98.22496.UNOFFICIAL
Create hunting rule

PUA.Win.Downloader.Aiis-6803892-0
Create hunting rule

Gathering data
Threat name:
Win32.Trojan.Ursnif
Create hunting rule
Status:
Malicious
First seen:
2020-04-17 16:35:23 UTC
File Type:
PE (Dll)
Extracted files:
2
AV detection:
22 of 31 (70.97%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=6ltt5zvlbllz4dgvg66yk3m6nfefdejcqo6kp63t5m74gnksqnjq._file
Verdict:
malicious
Label(s):
zloader
Create hunting rule
gozi
Create hunting rule
Similar samples:
2f2670e8a7845cf300320415c6a16ffc34e662672f16d7cfcf5b911d088516d9
ZLoader
3648fe001994cb9c0a6b510213c268a6bd4761a3a99f3abb2738bf84f06d11cf
ZLoader
4553d627f2509e19e9b84491c08ec9854d785df4f74e900b969c57ccd244c086
ZLoader
a47685b867e6b164a812a05f35b6732c9b81f1fc75b2a7242c18436a9329d247
ZLoader
bc0b57f04efe4239fcc02f049c97016c653c963de8cbe45bcf9449cd16919f08
ZLoader
c44e8d9dba3b4a4cc835b460e69d336347fd3fbfb67621d7cd6e8723976607ce
ZLoader
c55e3938e9c2c9d00235d8ed87a55adc18fa1c6377a9ee0fd6212916c67d0020
ZLoader
e4601ce15ad7bca4617ad033f129a5d507f8e55b979c97a78cf31a6f501cb046
ZLoader
f27183fd7586c6eaca1f6aaed3a7c3c6e52894e23b9656c3953318a85bbbec5d
ZLoader
fffd7bc61eb5b9759a97699efdf9455b76d9e198b87d75ebdb8a2fa2a4a08306
ZLoader
+ 33 additional samples on MalwareBazaar
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

ZLoader

DLL dll f2e73ee6ab0ad79e0cd537bd856d9e694851912283bca7fb73eb3fc335528353

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/342496/
  
X
https://twitter.com/DynamicAnalysis/status/1251163062628831239
  
Delivery method
Distributed via web download

BLint

The following table provides more information about this file using BLint. BLint is a Binary Linter to check the security properties, and capabilities in executables.

Findings
IDTitleSeverity
CHECK_AUTHENTICODEMissing Authenticodehigh
CHECK_DLL_CHARACTERISTICSMissing dll Security Characteristics (HIGH_ENTROPY_VA)high
Reviews
IDCapabilitiesEvidence
WIN32_PROCESS_APICan Create Process and ThreadsKERNEL32.dll::CloseHandle
WIN_BASE_APIUses Win Base APIKERNEL32.dll::TerminateProcess
KERNEL32.dll::LoadLibraryExW
KERNEL32.dll::GetStartupInfoW
KERNEL32.dll::GetCommandLineA
KERNEL32.dll::GetCommandLineW
WIN_BASE_EXEC_APICan Execute other programsKERNEL32.dll::WriteConsoleW
KERNEL32.dll::SetStdHandle
KERNEL32.dll::GetConsoleCP
KERNEL32.dll::GetConsoleMode
WIN_BASE_IO_APICan Create FilesKERNEL32.dll::CreateFileA
KERNEL32.dll::CreateFileW
KERNEL32.dll::GetWindowsDirectoryA

Comments