MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 38115c7bdc10cc2981e9ab126d98f5ccab66a4d4d787b90a704ba3823b07fb67. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


ZLoader


Vendor detections: 8


Intelligence 8 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 38115c7bdc10cc2981e9ab126d98f5ccab66a4d4d787b90a704ba3823b07fb67
SHA3-384 hash: fd93823cef043de1f6773c674e4b4b02f19cc339cf30a36f25cc81ded2fac30cb1fcaf38eea96840f36a1192537b9d20
SHA1 hash: de323c3e4f362739cc6cf0a9989fbde6633d3bd5
MD5 hash: a233e89a46b954cd46e6d543b96fd884
humanhash: coffee-butter-hot-robert
File name:zloader 2_1.0.18.0.vir
Download: download sample
Signature ZLoader
Create hunting rule
File size:458'752 bytes
First seen:2020-07-19 17:22:15 UTC
Last seen:2020-07-19 19:16:15 UTC
File type:DLL dll
MIME type:application/x-dosexec
imphash 9c48e134ef0c7df8d9348f63c095309e (1 x ZLoader)
ssdeep 12288:YsPxh4XMy2/z7uI8fb53/nq9YDRMTC/MCi:YKxiXu7n8fl3/oC/MCi
Threatray 56 similar samples on MalwareBazaar
TLSH 9DA49EC038D185B1EA0955F80C0E99E3C95ABE759CF2D187B7D83A9F211B16B6A33D31
Reporter tildedennis
Tags:ZLoader zloader 2


Avatar
tildedennis
zloader 2 version 1.0.18.0

Intelligence

File Origin
# of uploads :
2
# of downloads :
79
Origin country :
n/a
Vendor Threat Intelligence
Detection:
Zloader
Create hunting rule
Link:
https://www.capesandbox.com/analysis/27970/
Detection(s):
PUA.Win.Packer.PrivateExeProte-11
Create hunting rule

SecuriteInfo.com.Trojan.GenericKD.42677794.24720.19358.UNOFFICIAL
Create hunting rule

PUA.Win.Downloader.Aiis-6803892-0
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
Unauthorized injection to a recently created process
Connection attempt to an infection source
Result
Threat name:
ZLoader
Create hunting rule
Detection:
malicious
Classification:
troj.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/389858
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 247103 Sample: zloader 2_1.0.18.0.vir Startdate: 19/07/2020 Architecture: WINDOWS Score: 100 33 Multi AV Scanner detection for domain / URL 2->33 35 Malicious sample detected (through community Yara rule) 2->35 37 Antivirus detection for dropped file 2->37 39 4 other signatures 2->39 7 loaddll32.exe 1 2->7         started        10 rundll32.exe 2->10         started        12 rundll32.exe 2->12         started        process3 dnsIp4 29 1.0.18.0 VECTANTARTERIANetworksCorporationJP Japan 7->29 14 rundll32.exe 7->14         started        17 rundll32.exe 7->17         started        19 rundll32.exe 10->19         started        21 rundll32.exe 12->21         started        process5 signatures6 41 Contains functionality to inject code into remote processes 14->41 43 Writes to foreign memory regions 14->43 45 Allocates memory in foreign processes 14->45 23 msiexec.exe 3 25 14->23         started        process7 dnsIp8 31 soficatan.site 23->31 27 C:\Users\user\AppData\...\caycfyfy.dll, PE32 23->27 dropped file9
Detection:
zloader
Create hunting rule
Link:
https://mwdb.cert.pl/sample/38115c7bdc10cc2981e9ab126d98f5ccab66a4d4d787b90a704ba3823b07fb67/
Threat name:
Win32.Trojan.Kryptik
Create hunting rule
Status:
Malicious
First seen:
2020-02-25 01:40:36 UTC
AV detection:
20 of 31 (64.52%)
Threat level:
  5/5
Verdict:
malicious
Label(s):
gozi
Create hunting rule
Similar samples:
1130c38b05892129ef1a97693b0d3797a45ec69fe0d95bc28e4b09e3d4dd0e9c
ZLoader
15e6a048813e1fa7e06751b3cccd6125d7b8efb3ed160931213ac44eafa60807
ZLoader
2cefb03b68c5489c2abdde9993aa85d8465a26ce9ddb78849ee5e198103fdf6a
ZLoader
30e772385fc3887fdd1ef1e358dc05cc83da655ecf53257800daf5d68ae430fd
ZLoader
4ca3ae0f9b573739e66192f15aade1cf3d409ef133a7b6834ad4e387dea498a5
ZLoader
6576da1f0d0e8c2d7457c2898d0b8d2d7ad40527c60473910f86da6cf39c0951
ZLoader
af6af9c2d50e7c692521dac219b7f2f23c6b677216267dcbaf44bd44f7290d70
ZLoader
b7f3b8c8e8cd3b886baea02961ce6968315359a78e4af1edc51f930ae4ebd67b
ZLoader
da164dc8c1baf31539335b6a14ca2f14cc0f8a4a39523479290437d0810b82e3
ZLoader
f2e73ee6ab0ad79e0cd537bd856d9e694851912283bca7fb73eb3fc335528353
ZLoader
+ 46 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  6/10
Tags:
n/a
Link:
https://tria.ge/reports/200719-l51fp63zbe/
Behaviour
JavaScript code in executable
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Unknown
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/38115c7bdc10cc2981e9ab126d98f5ccab66a4d4d787b90a704ba3823b07fb67

File information

The table below shows additional information about this malware sample such as delivery method and external references.

  
Link
https://zeusmuseum.com/zloader 2/
Cape
Cape
https://www.capesandbox.com/analysis/27970/

Comments