MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 23843640cfae43671a48b17dc4fe585a8e37e3767039f82448077c5b54694a57. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


ZLoader


Vendor detections: 6


Intelligence 6 IOCs YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 23843640cfae43671a48b17dc4fe585a8e37e3767039f82448077c5b54694a57
SHA3-384 hash: b84f6c2478c3b596751ed3e3b6bc646c3f18e48cc26d1cd04ef4c297153201f3445398a2919efbc136e793696976fa22
SHA1 hash: eb992300f7fd49d3723737a39782bd4c46b4e566
MD5 hash: 01fdd1c8cc5e5c69f3d5507a25367263
humanhash: mountain-oranges-river-fix
File name:ylyz.dll
Download: download sample
Signature ZLoader
Create hunting rule
File size:340'824 bytes
First seen:2020-07-07 07:24:12 UTC
Last seen:Never
File type:DLL dll
MIME type:application/x-dosexec
imphash 9592b2e3b7b325317ae83ec2fab73421 (1 x Dridex, 1 x ZLoader)
ssdeep 6144:5HtkcFpDF8ZNb3YLJQm3fLrhdFNUDaq6Ix1QDlK4xh:vk0F8Z9gGkLVDGDaC1QDlKw
Threatray 153 similar samples on MalwareBazaar
TLSH 1B74D011636F007FEC8AA77260E593669A19AC7A19FCD0AAD78179ED3CF417051223CF
Reporter JAMESWT_WT
Tags:dll ZLoader

Code Signing Certificate

Organisation:MVRIKTPRSDUBLRMUTK
Issuer:MVRIKTPRSDUBLRMUTK
Algorithm:sha1WithRSA
Valid from:Jun 17 04:05:13 2020 GMT
Valid to:Dec 31 23:59:59 2039 GMT
Serial number: -6177841A06C5737EB3E9EFE58851C5F4
Intelligence: 2 malware samples on MalwareBazaar are signed with this code signing certificate
Thumbprint Algorithm:SHA256
Thumbprint: 834F0E313B473531ECFDA920931563D556B51B62997798F51C83D897CCA2B77E
Source:This information was brought to you by ReversingLabs A1000 Malware Analysis Platform

Intelligence

File Origin
# of uploads :
1
# of downloads :
82
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/21896/
Detection(s):
Win.Malware.Agent-8366027-0
Create hunting rule

Result
Verdict:
Clean
Maliciousness:

Behaviour
Launching a process
Detection:
zloader
Create hunting rule
Link:
https://mwdb.cert.pl/sample/23843640cfae43671a48b17dc4fe585a8e37e3767039f82448077c5b54694a57/
Threat name:
Win32.Trojan.Kryptik
Create hunting rule
Status:
Malicious
First seen:
2020-06-17 16:42:16 UTC
File Type:
PE (Dll)
Extracted files:
35
AV detection:
23 of 29 (79.31%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=eocdmqgpvzbwogsiwf64j7sylkhdpy3woa47qjcia56fwvdjjjlq._file
Verdict:
malicious
Label(s):
zloader
Create hunting rule
Similar samples:
00272dd639402fa76db43207d074fe52d4849e5d46008f786b944a789b09afc2
ZLoader
0c8569e4304f46352b041dcb692f85c9e195130db2013d4f2216130603478035
ZLoader
25d19c2c3cb08b7634e2bc8ec87f05765bca558e74899c9e71e576d23cd70266
ZLoader
431a34f1ab6dec2c646b408b9b5ce091882244fde39498484fc0c73390d8f7f0
ZLoader
56f9b54e1e16887d66b8b9b7ea71d610951c18662a132cf7c9900d67b9745e81
ZLoader
5b831fb067dfb53992bb8a346e4fc038de6441a94ad5a3932dc8bd64f80e56fc
ZLoader
8a07427bbf6b92d273580d2806da69c0059aa574a63dad2bd061445c985d67be
ZLoader
a2387ef5d3af113c8c902f478df1c2d7f7a7acf729873b13508c1f1915bf5000
ZLoader
b715ce2fa69bc8384df1a4137b50bc30e05c0f3f557fe8608635744543b9976d
ZLoader
dec5d4a8805defd810a545d6cb3e46cb7bb72a63f0d1c60cef82baf15bfad39b
ZLoader
+ 143 additional samples on MalwareBazaar
Result
Malware family:
zloader
Create hunting rule
Score:
  10/10
Tags:
trojan botnet family:zloader persistence
Link:
https://tria.ge/reports/200707-evaefkaghx/
Behaviour
Suspicious use of WriteProcessMemory
Suspicious use of AdjustPrivilegeToken
Suspicious use of SetThreadContext
Adds Run entry to start application
Zloader, Terdot, DELoader, ZeusSphinx
Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:win_zloader_auto
Create hunting rule
Author:Felix Bilstein - yara-signator at cocacoding dot com
Description:autogenerated rule brought to you by yara-signator

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/21896/

Comments