MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 270cbb3393119258ff8db610d8b48556b582c3fcd1bfeca457a6311b5cdf0908. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

ZLoader

Vendor detections: 7

Intelligence 7 IOCs YARA 3 File information Comments

SHA256 hash:	270cbb3393119258ff8db610d8b48556b582c3fcd1bfeca457a6311b5cdf0908
SHA3-384 hash:	0a6b675a6c51fbbd178323467bb6df52a362a99304127c193b61751ea989e0c329bfb9db3e83b0e511bc3297cf348887
SHA1 hash:	fe6083dfea6a0727e6f9ec215fa1bddd6a981b8b
MD5 hash:	87e4b79e02c038bb1dda5e53bd502703
humanhash:	venus-johnny-cup-happy
File name:	WIm6.dll
Download:	download sample
Signature	ZLoader Create hunting rule
File size:	633'856 bytes
First seen:	2021-03-30 21:32:47 UTC
Last seen:	2021-03-30 22:46:23 UTC
File type:	dll
MIME type:	application/x-dosexec
imphash	68f3f2a2ffe0dad5256ecadb0543767a (5 x ZLoader)
ssdeep	12288:eRNmLFMfAqHo/W5ChAUCEFAyjbMuYjUX3VoEuh1+RoqfxWh9x01qM:mKMfAEo/PhAVPEcgRHfIKoM
Threatray	14 similar samples on MalwareBazaar
TLSH	5DD4AF02A7E18034F5B31BF845BF64688ABE79E0073880DB52C425ED5B37AE4AD3475B
Reporter	ffforward
Tags:	dll ZLoader

Intelligence

File Origin

# of uploads :

# of downloads :

148

Origin country :

n/a

Vendor Threat Intelligence

Detection:

Zloader

Link:

https://www.capesandbox.com/analysis/128761/

Detection(s):

SecuriteInfo.com.ML.PE-A.18453.32606.UNOFFICIAL

Result

Verdict:

Clean

Maliciousness:

Behaviour

Sending a UDP request

Verdict:

Suspicious

Link:

https://analyze.intezer.com/analyses/27c0e459-07a8-478b-ae62-7bc793b054ba

Result

Threat name:

Unknown

Detection:

malicious

Classification:

n/a

Score:

52 / 100

Link:

https://www.joesandbox.com/analysis/659147

Signature

Machine Learning detection for sample

Multi AV Scanner detection for submitted file

Behaviour

Behavior Graph:

Download SVG

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/270cbb3393119258ff8db610d8b48556b582c3fcd1bfeca457a6311b5cdf0908/

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=e4glwm4tcgjfr74nwyinrnefk22yfq742g76zjcxuyyrwxg7beea._file

Verdict:

malicious

Label(s):

zloader

Result

Malware family:

n/a

Score:

1/10

Tags:

n/a

Link:

https://tria.ge/reports/210330-zse86rmn4j/

Behaviour

Suspicious use of WriteProcessMemory

Unpacked files

SH256 hash:

8db3c9addc2ac64bfe13bcfb8bef381ab86a139ee3e1409cdae66a4668f040e9

MD5 hash:

43644a623708211bb8824e7478cb1955

SHA1 hash:

b3f95e6723922c5aabd9d7966d16cdad9a2632da

Detections:

win_zloader_auto

Link:

https://www.unpac.me/results/95e95193-9865-4e78-9032-f9f66f40bbe1/

SH256 hash:

270cbb3393119258ff8db610d8b48556b582c3fcd1bfeca457a6311b5cdf0908

MD5 hash:

87e4b79e02c038bb1dda5e53bd502703

SHA1 hash:

fe6083dfea6a0727e6f9ec215fa1bddd6a981b8b

Link:

https://www.unpac.me/results/95e95193-9865-4e78-9032-f9f66f40bbe1/

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/270cbb3393119258ff8db610d8b48556b582c3fcd1bfeca457a6311b5cdf0908

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	crime_win32_zloader_a0 Create hunting rule
Author:	Rony (@r0ny_123)
Description:	Detects Zloader Payload

Rule name:	win_zloader_auto Create hunting rule
Author:	Felix Bilstein - yara-signator at cocacoding dot com
Description:	autogenerated rule brought to you by yara-signator