MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 3a4ca58b0a2e72a264466a240c6636f62b8742ffbc96ce14e2225f0e57012e96. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


ZLoader


Vendor detections: 10


Intelligence 10 IOCs YARA 1 File information Comments 1
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 3a4ca58b0a2e72a264466a240c6636f62b8742ffbc96ce14e2225f0e57012e96
SHA3-384 hash: 30a7f3eab44c7280eee41eaf12d2a7f7ebf1a7c8702439ca59aafeed281dc6f7652bbbe59d4c1871f3f15112435cb8ea
SHA1 hash: cc4bba83f31c2d15ebd9432e3d832a4c3de8c516
MD5 hash: 2f5674540983bc9a2d8ceb2078fa01b6
humanhash: paris-single-triple-magazine
File name:unpacked_zloader_21_10_4.dll
Download: download sample
Signature ZLoader
Create hunting rule
File size:149'504 bytes
First seen:2021-10-18 15:32:20 UTC
Last seen:2021-10-18 17:18:34 UTC
File type:DLL dll
MIME type:application/x-dosexec
imphash e8478bbcb7a4fed9fd3a17a0d9e29028 (1 x ZLoader)
ssdeep 3072:zad/Bacuyiy13Babz1w+99lfuFhUgrIH2xqUpw/VAfyV:OdD13B6zd99gUgrIHOqUpw9Aa
Threatray 82 similar samples on MalwareBazaar
TLSH T1BEE33A16A854C638F80100B55DACBB7E9C5AC50D7A238ABBC7C1C8D09FE96B0777E61D
Reporter aaqeel87
Tags:123 dll unpacked ZLoader

Intelligence

File Origin
# of uploads :
2
# of downloads :
285
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/198255/
Detection(s):
SecuriteInfo.com.Trojan.DownLoader43.35355.23979.4774.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:
Verdict:
Likely Malicious
Threat level:
  7.5/10
Confidence:
67%
Tags:
greyware
Link:
https://www.filescan.io/uploads/616d93b3db358dd15ebfec7e/reports/515efe08-f2d5-43e8-8c23-ec673f85b514/overview
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
Zloader
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/2a569577-7d67-4026-85e1-e9c7f83d7e89
Result
Threat name:
ZLoader
Create hunting rule
Detection:
malicious
Classification:
troj.evad
Score:
84 / 100
Link:
https://www.joesandbox.com/analysis/872426
Signature
Antivirus / Scanner detection for submitted sample
C2 URLs / IPs found in malware configuration
Found malware configuration
Found potential dummy code loops (likely to delay analysis)
Machine Learning detection for sample
Multi AV Scanner detection for submitted file
Yara detected ZLoader
Behaviour
Behavior Graph:
Download SVG
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/3a4ca58b0a2e72a264466a240c6636f62b8742ffbc96ce14e2225f0e57012e96/
Threat name:
Win32.Downloader.ZLoader
Create hunting rule
Status:
Malicious
First seen:
2021-10-18 15:33:08 UTC
AV detection:
18 of 28 (64.29%)
Threat level:
  3/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=hjgklcykfzzkezcgnisayzrw6yvyoqx7xslm4fhcejpq4vybf2la._file
Verdict:
malicious
Label(s):
zloader
Create hunting rule
Similar samples:
287352aca562a84f441ad7794832770ddfe283a8f05bab7a37f2ba66f3dc7edf
ZLoader
3c983bfb316b633fa71608b49f7aae4968a71d0178aef4733a86bfc99dd41f23
ZLoader
4b0c5b4530a9218d6030a7040a10ea5be84ffa3696601732ee7212691521474f
ZLoader
95b19f6107e6ed6af9b335d7ceed88a77ec8cb3864b09d70b6ea2f6ca9c13e9a
ZLoader
9f461b952b6e648c57d22e3a4728494c11871a919ec73947cffe360dd4dd17ba
ZLoader
b1cad1fdb90afa5722f57f01ed27c7b6db5394977990bfb45f61873e270b1dc5
ZLoader
b4c029f9bb6d85ace85302d25caa7ec1da9d641872ea8f62b333a667c0d7b864
ZLoader
c4ab81d7b7d44dd6dfc4f2b69dbe3f22fbf23c1ae49ab8edac2d26f85ae4514d
ZLoader
edb9d542cbc5ab07fd52792e20294f82b51de49c3d32938cbd9b55b2374d2b55
ZLoader
+ 72 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  1/10
Tags:
n/a
Link:
https://tria.ge/reports/211018-sy76bsdgf9/
Behaviour
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Unpacked files
SH256 hash:
3a4ca58b0a2e72a264466a240c6636f62b8742ffbc96ce14e2225f0e57012e96
MD5 hash:
2f5674540983bc9a2d8ceb2078fa01b6
SHA1 hash:
cc4bba83f31c2d15ebd9432e3d832a4c3de8c516
Detections:
win_zloader_auto
Create hunting rule
Link:
https://www.unpac.me/results/2a553949-73bd-4a14-b2ed-cf9bdccb332c/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/3a4ca58b0a2e72a264466a240c6636f62b8742ffbc96ce14e2225f0e57012e96

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:win_zloader_auto
Create hunting rule
Author:Felix Bilstein - yara-signator at cocacoding dot com
Description:Detects win.zloader.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/198255/

Comments


Avatar
Ali Aqeel commented on 2021-10-18 16:36:31 UTC

[Blog] write-up analyzing #Zloader malware.

Ref: https://aaqeel01.wordpress.com/2021/10/18/zloader-reversing/
tweet: https://twitter.com/aaqeel87/status/1450134416903262222?s=20