MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 24c57cf9a9fd72827ced5f95796cf333089f076c660bf06b5e7d071a4d5fc102. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


ZLoader


Vendor detections: 6


Intelligence 6 IOCs YARA File information Comments 1
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 24c57cf9a9fd72827ced5f95796cf333089f076c660bf06b5e7d071a4d5fc102
SHA3-384 hash: 1de263b321ad2f1c97cef399ecf024b57ff798e0b0a26db87029a782b28f150522ee79406ff689825a55d5076ea439af
SHA1 hash: c9accdc1204579d13440df22e4892fcc2082dc7c
MD5 hash: c43c3c195e838ef81a36c1434fa7395c
humanhash: saturn-missouri-artist-violet
File name:c43c3c195e838ef81a36c1434fa7395c
Download: download sample
Signature ZLoader
Create hunting rule
File size:975'024 bytes
First seen:2021-08-09 05:06:36 UTC
Last seen:2024-07-25 00:54:11 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash 21032b08528b054e353a7a5a56440c82 (1 x ZLoader, 1 x Formbook)
ssdeep 12288:8ioQBrcKxHPULy+QVo5XeT8zZlmVlC+Q2cjQ7CJXPcq9y:89Q9cKxHo55Og9lU4xo
Threatray 28 similar samples on MalwareBazaar
TLSH T1E8258FC379CDBDD6D03A6672FB3783E9C25EEC1489A0849F61D43579897822332A23D5
dhash icon d4b29ecca8b2ae00 (1 x ZLoader, 1 x Formbook)
Reporter zbetcheckin
Tags:exe ZLoader

Intelligence

File Origin
# of uploads :
2
# of downloads :
152
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
c43c3c195e838ef81a36c1434fa7395c
Verdict:
No threats detected
Analysis date:
2021-08-09 05:08:42 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/d51a3718-7c01-477f-ac14-30b8d5881509

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/177369/
Detection(s):
SecuriteInfo.com.W32.AIDetect.malware2.6040.3366.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Sending a UDP request
Result
Verdict:
UNKNOWN
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/35a66b7e-a011-40c4-bc73-4858a548a87f
Result
Threat name:
Unknown
Detection:
malicious
Classification:
n/a
Score:
52 / 100
Link:
https://www.joesandbox.com/analysis/829155
Signature
Multi AV Scanner detection for submitted file
PE file has a writeable .text section
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 461588 Sample: JGBqCvZfJj Startdate: 09/08/2021 Architecture: WINDOWS Score: 52 28 Multi AV Scanner detection for submitted file 2->28 30 PE file has a writeable .text section 2->30 7 loaddll32.exe 1 2->7         started        process3 process4 9 iexplore.exe 1 73 7->9         started        11 cmd.exe 1 7->11         started        13 regsvr32.exe 7->13         started        15 4 other processes 7->15 process5 17 iexplore.exe 104 9->17         started        20 rundll32.exe 11->20         started        dnsIp6 22 geolocation.onetrust.com 104.20.184.68, 443, 49724, 49725 CLOUDFLARENETUS United States 17->22 24 www.msn.com 17->24 26 6 other IPs or domains 17->26
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/24c57cf9a9fd72827ced5f95796cf333089f076c660bf06b5e7d071a4d5fc102/
Threat name:
Win32.Downloader.Zload
Create hunting rule
Status:
Malicious
First seen:
2021-08-09 00:12:13 UTC
AV detection:
10 of 47 (21.28%)
Threat level:
  3/5
Verdict:
malicious
Label(s):
zloader
Create hunting rule
Similar samples:
06f39b7745fc370b817fc6f4ba226ac2f39994bf7da7296a99feb68d730ed174
ZLoader
12e5c221195f7d0a47b98b5d5fff26ea8fc4ad4f76f1c21f47e3a73102f18c59
ZLoader
481af12b4e027b76b68c817c3cb806291f52042d3b5dce2e9f073408f596e206
ZLoader
6c8e5f1670515c6a9d3cdcafe6d9a782a87f0f085095558cc0116ea73281c059
ZLoader
86c37d778f584a2a3090ab170c8cd2fb3ddf952cde689b4c5a1efd74fc113a05
ZLoader
892ec03552cca2c62495e661fda9bfd113009f2d9b0a07c2b13d9f047953cb2f
ZLoader
9c201b6131cd721438f814bd308168b95a3bfbc7785c9ac2ee19209ae50e8232
ZLoader
cbf6848b72b118e090953347982de71cfe1510dfdc4affdb1ee4d5d62af428d6
ZLoader
+ 18 additional samples on MalwareBazaar
Result
Malware family:
zloader
Create hunting rule
Score:
  10/10
Tags:
family:zloader botnet:vasja campaign:vasja botnet trojan
Link:
https://tria.ge/reports/210809-nv795ae2pa/
Behaviour
Suspicious use of WriteProcessMemory
Zloader, Terdot, DELoader, ZeusSphinx
Malware Config
C2 Extraction:
https://iqowijsdakm.com/gate.php
https://wiewjdmkfjn.com/gate.php
https://dksaoidiakjd.com/gate.php
https://iweuiqjdakjd.com/gate.php
https://yuidskadjna.com/gate.php
https://olksmadnbdj.com/gate.php
https://odsakmdfnbs.com/gate.php
https://odsakjmdnhsaj.com/gate.php
https://odjdnhsaj.com/gate.php
https://odoishsaj.com/gate.php
Unpacked files
SH256 hash:
24c57cf9a9fd72827ced5f95796cf333089f076c660bf06b5e7d071a4d5fc102
MD5 hash:
c43c3c195e838ef81a36c1434fa7395c
SHA1 hash:
c9accdc1204579d13440df22e4892fcc2082dc7c
Link:
https://www.unpac.me/results/00785bcc-4617-4e7a-801f-5c36cb29071f/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Suspicious File
Score:
0.30
Link:
https://yomi.yoroi.company/submissions/24c57cf9a9fd72827ced5f95796cf333089f076c660bf06b5e7d071a4d5fc102

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

ZLoader

Executable exe 24c57cf9a9fd72827ced5f95796cf333089f076c660bf06b5e7d071a4d5fc102

(this sample)

  
Delivery method
Distributed via web download
  
URLhaus
https://urlhaus.abuse.ch/url/1518105/
Cape
Cape
https://www.capesandbox.com/analysis/177369/

Comments


Avatar
zbet commented on 2021-08-09 05:06:37 UTC

url : hxxps://gucdhwpcfjmmcefypliv.com/JavaE.dll