MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 00e0c18191f6300aa197b657c7596a2fc85247572d64ff3c2711b0b5707c2d13. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


ZLoader


Vendor detections: 8


Intelligence 8 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 00e0c18191f6300aa197b657c7596a2fc85247572d64ff3c2711b0b5707c2d13
SHA3-384 hash: d3cdb30e1bb1bd66eb2f6831118ef021b570d72719ae6796d31897c86ba15149c323a172039a3042595a678411d13584
SHA1 hash: c3923ca68af7d40707ec5c57c34ba3a0148d1165
MD5 hash: 6790bafd94fadc8f1382c40ded250c42
humanhash: yellow-aspen-ack-alabama
File name:6790bafd94fadc8f1382c40ded250c42.dll
Download: download sample
Signature ZLoader
Create hunting rule
File size:1'169'920 bytes
First seen:2020-10-23 07:11:55 UTC
Last seen:Never
File type:DLL dll
MIME type:application/x-dosexec
imphash 19627cb436f84a78ee209769bd6188f1 (2 x ZLoader)
ssdeep 24576:Z727PUky++IcuUpy6DV41veBDqQJyNlKOWyqc:Z727PUkyA1441veRqQJ6lK
Threatray 36 similar samples on MalwareBazaar
TLSH D045F1627686E82AC12E8638CE84ECFC66567D099F685CD730C47F0F39378654F78A19
Reporter abuse_ch
Tags:dll ZLoader

Intelligence

File Origin
# of uploads :
1
# of downloads :
94
Origin country :
n/a
Vendor Threat Intelligence
Detection:
Zloader
Create hunting rule
Link:
https://www.capesandbox.com/analysis/74971/
Detection(s):
SecuriteInfo.com.Variant.Zusy.322673.30562.26505.UNOFFICIAL
Create hunting rule

Result
Verdict:
Clean
Maliciousness:

Behaviour
Sending a UDP request
Creating a file in the %temp% directory
Delayed writing of the file
Delayed reading of the file
Result
Threat name:
Unknown
Detection:
malicious
Classification:
n/a
Score:
48 / 100
Link:
https://www.joesandbox.com/analysis/507885
Signature
A
b
c
d
e
f
i
l
M
n
o
r
S
t
u
V
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 303067 Sample: TBE2MhKCOM.dll Startdate: 23/10/2020 Architecture: WINDOWS Score: 48 12 Multi AV Scanner detection for submitted file 2->12 6 loaddll32.exe 1 2->6         started        process3 process4 8 rundll32.exe 6->8         started        10 rundll32.exe 1 6->10         started       
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/00e0c18191f6300aa197b657c7596a2fc85247572d64ff3c2711b0b5707c2d13/
Threat name:
Win32.Trojan.Zeus
Create hunting rule
Status:
Malicious
First seen:
2020-10-22 14:40:46 UTC
AV detection:
22 of 29 (75.86%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=adqmdamr6yyavimxwzl4owlkf7efer2xfvsp6pbhcgylk4d4fujq._file
Verdict:
malicious
Label(s):
zloader
Create hunting rule
Similar samples:
49d7303aab08fdc92f4a19e794ff05b82b4286d2793cdef0f85821b7201ccacb
ZLoader
6058c6ad67825611365e2b30a4e8641f898a1f04c3d4edc4fc228ea7a5b5cb20
ZLoader
782ea4a6943ceafa3d1133c5cbba0bbb6cdd88953ffae7ab89ac8a7f79101e0a
ZLoader
78e34b21a5786410919826ed63c6c65ced1120074800f7349e772476cdbafc78
ZLoader
7a95f603035c2c64027d526ef17f75b4b8bb1b92a0c6e8c06ea639f89a83370c
ZLoader
ad213eaf7436c9ebd4d1e3fe24ce4963a8d878b1b625198d5c8085c383f580dd
ZLoader
e39733c3bd6797321692280fc4a9b60ac906df855c4076b8952e2bcb60e65344
ZLoader
ea2f669164d78dda6cfa73ec8cf823944855d3cd711714694bde177feba932f9
ZLoader
f541c495c3b6652928198822b24a27cce575ee1c8c2d6a0e42805cdbf8da59e8
ZLoader
fa5758be81ae8ec4d4f2c4f403a9caa31fd6508100d3cd718190ab9320f3eba4
ZLoader
+ 26 additional samples on MalwareBazaar
Result
Malware family:
zloader
Create hunting rule
Score:
  10/10
Tags:
trojan botnet family:zloader
Link:
https://tria.ge/reports/201023-vj1xfhbkge/
Behaviour
Suspicious use of WriteProcessMemory
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of SetThreadContext
Blacklisted process makes network request
Zloader, Terdot, DELoader, ZeusSphinx
Suspicious use of NtCreateUserProcessOtherParentProcess
Malware Config
C2 Extraction:
http://wingtonwelbemdon.com/web/post.php
http://donburitimesofindia.com/web/post.php
http://celtictimesofkarishan.com/web/post.php
http://welcometothehotelsoflifes.com/web/post.php
http://wheredidtheelllcctoncsgo.com/web/post.php
http://myworld2002020999.com/web/post.php
Unpacked files
SH256 hash:
00e0c18191f6300aa197b657c7596a2fc85247572d64ff3c2711b0b5707c2d13
MD5 hash:
6790bafd94fadc8f1382c40ded250c42
SHA1 hash:
c3923ca68af7d40707ec5c57c34ba3a0148d1165
Link:
https://www.unpac.me/results/ec64126b-84f6-4b23-a640-27e31a874189/
SH256 hash:
7db772d6d9909cb3b4f5fcf0572ddebd72de3e191a83babb9d5a66bb9eb640a2
MD5 hash:
6e543c620d7e80431daec41c8d510dfb
SHA1 hash:
c4f0238e3630564ad1fce84414e4ea18d4633b5e
Detections:
win_zloader_auto
Create hunting rule
Link:
https://www.unpac.me/results/ec64126b-84f6-4b23-a640-27e31a874189/
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

ZLoader

DLL dll 00e0c18191f6300aa197b657c7596a2fc85247572d64ff3c2711b0b5707c2d13

(this sample)

Cape
Cape
https://www.capesandbox.com/analysis/74971/
  
URLhaus
https://urlhaus.abuse.ch/url/733905/
  
Delivery method
Distributed via web download

Comments