MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 21f41071eb31d4b4f2fb1e5d9be035014b1302313804e46077ca23da0dd30bc8. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Intelligence File information Yara Comments

SHA256 hash: 21f41071eb31d4b4f2fb1e5d9be035014b1302313804e46077ca23da0dd30bc8
SHA3-384 hash: 3b9edc637c463c535aba132b77ab2cc7ebb593ab0235d9ffb02c67664437baf225ae6bf74f0eec38cafae889ee55cc0f
SHA1 hash: 0c012857690e0eebf10eb0ccafcbad9434f99d91
MD5 hash: 07e6b50724981e0c96f7d23f48d309b5
humanhash: autumn-angel-stairway-happy
File name:zloader 2_1.0.13.0.vir
Download: download sample
Signature ZLoader
File size:157'696 bytes
First seen:2020-07-19 19:32:53 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash 0012131c357107fbab066d88c6119ad6
ssdeep 3072:NOgSKE2Om5C3nAnpedwh6cXtoqnDqQ8CrE6mA3b77BJDg:MgSKEhmcQnpSwh6cu0T8CY6mA3/7X
TLSH 91F3ADF02DE846F2E91B813B275D4BCFDD9EA1128AF5994113F57274070147EAEE242E
Reporter @tildedennis
Tags:ZLoader zloader 2


Twitter
@tildedennis
zloader 2 version 1.0.13.0

Intelligence


File Origin
# of uploads :
1
# of downloads :
19
Origin country :
FR FR
Mail intelligence
No data
Vendor Threat Intelligence
Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
Unauthorized injection to a recently created process
Sending an HTTP GET request
Creating a file in the %temp% subdirectories
Reading critical registry keys
Creating a file
Deleting a recently created file
Reading Telegram data
Running batch commands
Creating a process with a hidden window
Launching a process
Sending a TCP request to an infection source
Stealing user critical data
Threat name:
Win32.Trojan.Emotet
Status:
Malicious
First seen:
2020-01-23 22:37:45 UTC
AV detection:
24 of 31 (77.42%)
Threat level
  2/5
Result
Malware family:
zloader
Score:
  10/10
Tags:
persistence trojan botnet family:zloader
Behaviour
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Suspicious use of SetThreadContext
Adds Run key to start application
Blacklisted process makes network request
Zloader, Terdot, DELoader, ZeusSphinx
Malware Config
Extraction:
https://dasifosafjasfhasf.com/gate.php
https://kasfajfsafhasfhaf.com/gate.php
https://fdsjfjdsfjdsjfdjsfh.com/gate.php
https://fdsjfjdsfjdsdsjajjs.com/gate.php
https://idisaudhasdhasdj.com/gate.php
https://dsjdjsjdsadhasdas.com/gate.php
https://dsdjfhdsufudhjas.com/gate.php
Threat name:
Unknown
Score:
1.00

File information


The table below shows additional information about this malware sample such as delivery method and external references.

Comments