MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 0263c76856472535f8441f582dac011dbf52f965086f9e59a6930c00b2106073. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


ZLoader


Vendor detections: 5


Intelligence 5 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 0263c76856472535f8441f582dac011dbf52f965086f9e59a6930c00b2106073
SHA3-384 hash: a924e745ff19d56151e24d7b090e7c53dbe721db2255c4d7d7193eacac42f0faeda97ed6e6cfcc37afa36b99ac8da73c
SHA1 hash: 2875140558c0c17a259ff2d731e5e4a0a823108a
MD5 hash: f18334d87221ecb0fb12405814c21912
humanhash: south-iowa-speaker-mexico
File name:wwf[1].bin
Download: download sample
Signature ZLoader
Create hunting rule
File size:2'361'856 bytes
First seen:2020-06-12 12:03:45 UTC
Last seen:2025-01-23 02:42:03 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash 33a8b0741e2541d608f37963b1035401 (6 x ZLoader)
ssdeep 49152:jUEJpE+TT7TDGBcuHsi7Ly2Cr2SRtgbR9iTp1woifnUWtMbuIJ0y:jBnE+TT/DGTHs8yVr2n99iTpiXfnUWtS
Threatray 64 similar samples on MalwareBazaar
TLSH AEB5CF32798184B6C1730771EE0DB36963ACB8700E34974772A49E6D2FB04936A6DBD7
Reporter JAMESWT_WT
Tags:ZLoader

Intelligence

File Origin
# of uploads :
2
# of downloads :
85
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/10055/
Detection(s):
SecuriteInfo.com.Win32.GenKryptik.EMIA.12844.UNOFFICIAL
Create hunting rule

Gathering data
Threat name:
Win32.Trojan.ZLoader
Create hunting rule
Status:
Malicious
First seen:
2020-06-12 12:05:07 UTC
File Type:
PE (Exe)
Extracted files:
17
AV detection:
25 of 31 (80.65%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=ajr4o2cwi4stl6ced5mc3labdw7vf6lfbbxz4wngsmgabmqqmbzq._file
Verdict:
malicious
Label(s):
gozi
Create hunting rule
zloader
Create hunting rule
Similar samples:
16dd0142263b0ecdd025ec808a6bdd74277eee53c1d9d6c603aafe460f9431d1
ZLoader
4faa13a20e77f72c5bfc411b914a57a832f22495f90ddfd2aca91908d22a7c94
ZLoader
53334b2b8901c9cfb03dfb61eee7fd5a86a15d3d5bcea947349fb7e9f991e5d6
ZLoader
5b23cf5a82a32b3cbde35d498665f99c1ae92a1bed50e23e80a5f2dae923b0a6
ZLoader
62dc32e85cf808c08cc70ef2de4028fcfd20a1e91d5aa88b1280d353faff5313
ZLoader
ab92b7c54f6fb064001b3dadf306f85efa7344fc9efa88070bbcd91164e80af2
ZLoader
b35ad69768a7ce3db49edb414b855e06236cc9948616b055bd2503e83c2564e7
ZLoader
c819184cbc9744c16063570200bea44d1eb2d7e99967b2e8153bd65634f883a2
ZLoader
ce45cdd40c147614de14a481a63afe924a3262282f7cff746fdd2d446749d7ba
ZLoader
f0276fc95acef71224471aecf0450febfc4b35e8ee9a98d97ce3cf39c669dd33
ZLoader
+ 54 additional samples on MalwareBazaar
Result
Malware family:
zloader
Create hunting rule
Score:
  10/10
Tags:
family:zloader botnet:bot7 campaign:bot7 botnet persistence trojan
Link:
https://tria.ge/reports/201109-etppewrhv2/
Behaviour
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Suspicious use of SetThreadContext
Adds Run key to start application
Zloader, Terdot, DELoader, ZeusSphinx
Malware Config
C2 Extraction:
https://militanttra.at/owg.php
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/10055/

Comments