🤲🏼 NEW | abuse.ch Community Hub! Earn recognition 🏅 for the malware intelligence you share, climb the leaderboards 📈, and connect with like-minded contributors who share your hunting focus 🤝. Ready to unlock your profile? Go to the Community Hub →

MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 1324f47fbabf9163ce0e2abf54231702b9f8725956429d272acef6a2dbc16c4e. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


ZLoader


Vendor detections: 9


Intelligence 9 IOCs YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 1324f47fbabf9163ce0e2abf54231702b9f8725956429d272acef6a2dbc16c4e
SHA3-384 hash: 9c4842d2b5258c17a68ede193dfd3276ccadf48d7e15b3467a731fa16e51f01cf2fd6306bd6cffd073fab1d8d43f2cf2
SHA1 hash: ba905e882b0f8e731956e34769eae093e329b575
MD5 hash: 15b27e2fa86503f6456f96a8310d82f0
humanhash: football-earth-shade-mexico
File name:1324f47fbabf9163ce0e2abf54231702b9f8725956429d272acef6a2dbc16c4e
Download: download sample
Signature ZLoader
Create hunting rule
File size:769'568 bytes
First seen:2020-10-19 08:19:33 UTC
Last seen:2020-10-19 09:08:31 UTC
File type:DLL dll
MIME type:application/x-dosexec
imphash d1a01d8a4a8591ad5fea3c5cda7ca3f1 (1 x ZLoader)
ssdeep 12288:4wVoRYznNkwKnugJz17aTzuj7Y5Avi3wso8+EhTntOCvyz8mmtSbqJeFiD1qRXGL:9VmYKweugNaC/cUw+E5WNmtMqYFI1qhA
Threatray 17 similar samples on MalwareBazaar
TLSH 4DF48D00BF91C039F1BF02BA597D51A9493CBE90477484EF93E4AADE5A356E18D34B23
Reporter JAMESWT_WT
Tags:GIE-MUTUALISTE ZLoader

Code Signing Certificate

Organisation:Symantec Time Stamping Services CA - G2
Issuer:Thawte Timestamping CA
Algorithm:sha1WithRSAEncryption
Valid from:Dec 21 00:00:00 2012 GMT
Valid to:Dec 30 23:59:59 2020 GMT
Serial number: 7E93EBFB7CC64E59EA4B9A77D406FC3B
Intelligence: 85 malware samples on MalwareBazaar are signed with this code signing certificate
Thumbprint Algorithm:SHA256
Thumbprint: 0625FEE1A80D7B897A9712249C2F55FF391D6661DBD8B87F9BE6F252D88CED95
Source:This information was brought to you by ReversingLabs A1000 Malware Analysis Platform

Intelligence

File Origin
# of uploads :
2
# of downloads :
105
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/72807/
Detection(s):
SecuriteInfo.com.Trojan.Siggen10.37923.31203.14091.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Sending a UDP request
Creating a file in the %temp% directory
Delayed writing of the file
Delayed reading of the file
Result
Threat name:
Unknown
Detection:
malicious
Classification:
n/a
Score:
56 / 100
Link:
https://www.joesandbox.com/analysis/495075
Signature
Antivirus / Scanner detection for submitted sample
Multi AV Scanner detection for submitted file
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 300008 Sample: bP9N3cSYJa Startdate: 19/10/2020 Architecture: WINDOWS Score: 56 16 Antivirus / Scanner detection for submitted sample 2->16 18 Multi AV Scanner detection for submitted file 2->18 6 loaddll32.exe 1 2->6         started        process3 process4 8 rundll32.exe 1 6->8         started        10 rundll32.exe 6->10         started        12 rundll32.exe 6->12         started        14 rundll32.exe 6->14         started       
Detection:
zloader
Create hunting rule
Link:
https://mwdb.cert.pl/sample/1324f47fbabf9163ce0e2abf54231702b9f8725956429d272acef6a2dbc16c4e/
Threat name:
Win32.Trojan.Zeus
Create hunting rule
Status:
Malicious
First seen:
2020-10-03 01:18:00 UTC
File Type:
PE (Dll)
Extracted files:
1
AV detection:
22 of 28 (78.57%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=cmspi752x6iwhtqofk7viiyxak47q4szkzbj2jzkz33kfw6bnrha._file
Verdict:
malicious
Label(s):
zloader
Create hunting rule
Similar samples:
30ddf8d34671494f41ef339a36a9a91d8593a297c299c16603c73e1842486284
ZLoader
34aa0d4ce98f0749715290301521365b5f44c627a5078ab168b912377b21d8f9
ZLoader
49d7303aab08fdc92f4a19e794ff05b82b4286d2793cdef0f85821b7201ccacb
ZLoader
63edc4ccc3345880ec3dd6e74360b45a0fa1e9b3147c21d245557ee0721fc347
ZLoader
7f3d84b5b13d9c150b3a8d047fe6db7a5c2ac3b97ca60e58d19fc16f09eb4bc6
ZLoader
93a47f8cffdd7f69d020813a390ffcf3bf850a5e53d398feba160f8efd2b5c43
ZLoader
b877fc9ef1769ee3f788c2da68b077d515c2b8356756e8cab9ececed99bbb7c1
ZLoader
baeafe5be147b00fb7af31b10ccdd139f17d335d3908c90d62d77668384a8cb2
ZLoader
c307f86ab5e3cc34c08e557ca6805bd8f0e024516c85b26516a5c35f1c516064
ZLoader
f045bc5d0dc4890be3163fa236c403dab3d444e92fd5ddc0356dbf3f25f829af
ZLoader
+ 7 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  1/10
Tags:
n/a
Link:
https://tria.ge/reports/201019-kvwabn4rjs/
Behaviour
Suspicious use of WriteProcessMemory
Unpacked files
SH256 hash:
1324f47fbabf9163ce0e2abf54231702b9f8725956429d272acef6a2dbc16c4e
MD5 hash:
15b27e2fa86503f6456f96a8310d82f0
SHA1 hash:
ba905e882b0f8e731956e34769eae093e329b575
Link:
https://www.unpac.me/results/d01435ed-a35f-4fb8-9862-148782b00bb2/
SH256 hash:
a53c80ef00d7c38e260bda94f2a77a6b0043da7ced89bd97a10611def1ac098e
MD5 hash:
54b70743c14e9c67c64321dfbe182a60
SHA1 hash:
78c293cdf98ec8af8b1ef2ec1e229fa96dc964ad
Detections:
win_zloader_auto
Create hunting rule
Link:
https://www.unpac.me/results/d01435ed-a35f-4fb8-9862-148782b00bb2/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
ZLoader
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/1324f47fbabf9163ce0e2abf54231702b9f8725956429d272acef6a2dbc16c4e

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:win_zloader_auto
Create hunting rule
Author:Felix Bilstein - yara-signator at cocacoding dot com
Description:autogenerated rule brought to you by yara-signator

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/72807/

Comments