🤲🏼 NEW | abuse.ch Community Hub! Earn recognition 🏅 for the malware intelligence you share, climb the leaderboards 📈, and connect with like-minded contributors who share your hunting focus 🤝. Ready to unlock your profile? Go to the Community Hub →

MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 3b3bf8030dbda7b4c12d965928bce68ed15341fa9d91ea4489ad3ca7aad6614d. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


ZLoader


Vendor detections: 9


Intelligence 9 IOCs YARA 2 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 3b3bf8030dbda7b4c12d965928bce68ed15341fa9d91ea4489ad3ca7aad6614d
SHA3-384 hash: c98a1035c50185e120abbd285b4956fe76e6fca21d6ec508f52d1f6dbedcd89e1da52ef57597d1f2defc3d362b2e9104
SHA1 hash: c4d715bd92f12d54c2a77e5c1ac1ef1a2d1957f5
MD5 hash: 6d72546fbb7cae443a46d6a744760f7e
humanhash: hamper-three-nine-violet
File name:3b3bf8030dbda7b4c12d965928bce68ed15341fa9d91ea4489ad3ca7aad6614d.dll
Download: download sample
Signature ZLoader
Create hunting rule
File size:136'704 bytes
First seen:2021-02-05 19:37:23 UTC
Last seen:Never
File type:DLL dll
MIME type:application/x-dosexec
imphash 8d3d9a57c38f5c094fac01c6e172cfd6 (2 x ZLoader)
ssdeep 3072:pJhZU0Hdfcw0IFNoZD31XDvVfG25xsJZRiK4XzMntN:rk090Pt9vVPkQX
Threatray 9 similar samples on MalwareBazaar
TLSH 32D328026C50C178F82110B56CACB7BE9D55C50D6A23CAABCBC1D8A49FDC6B0777E25E
Reporter Anonymous
Tags:ZLoader

Intelligence

File Origin
# of uploads :
1
# of downloads :
235
Origin country :
n/a
Vendor Threat Intelligence
Detection:
Zloader
Create hunting rule
Link:
https://www.capesandbox.com/analysis/115854/
Result
Verdict:
Malware
Maliciousness:

Behaviour
Sending a UDP request
Launching a process
Creating a file in the %AppData% subdirectories
Creating a window
DNS request
Sending a custom TCP request
Creating a file
Unauthorized injection to a system process
Result
Threat name:
Unknown
Detection:
malicious
Classification:
evad
Score:
84 / 100
Link:
https://www.joesandbox.com/analysis/600733
Signature
Allocates memory in foreign processes
Antivirus / Scanner detection for submitted sample
Antivirus detection for dropped file
Antivirus detection for URL or domain
Contains functionality to inject code into remote processes
Multi AV Scanner detection for dropped file
Writes to foreign memory regions
Behaviour
Behavior Graph:
Download SVG
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/3b3bf8030dbda7b4c12d965928bce68ed15341fa9d91ea4489ad3ca7aad6614d/
Threat name:
Win32.Trojan.Ymacco
Create hunting rule
Status:
Malicious
First seen:
2021-02-05 19:38:15 UTC
AV detection:
23 of 29 (79.31%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=hm57qaynxwt3jqjnszmsrphgr3ivgqp2twi6urejvu6kpkwwmfgq._file
Verdict:
malicious
Label(s):
zloader
Create hunting rule
Similar samples:
34aa0bd4dc61cca23b7950282df26ce2e16a339b2895add65d46e6d317a11fe1
ZLoader
35466f0c22f220890b932e59f9a21032712e8260343d13ad4c0d9560db3b638f
ZLoader
4b0c5b4530a9218d6030a7040a10ea5be84ffa3696601732ee7212691521474f
ZLoader
5c0f9c9babc640a2578b1d3e8cacb60df32a0437ef3f9383d00ed88a7cef3a62
ZLoader
5c5c8af2a703aa1842f4ce9f9e83aeeac0e2cc2d3ed1bf9f9ad72b7f77e89a42
ZLoader
78c4bc3ae3153ba126c58e5cf86f254468c8ff422971ea3923502bfa3de8ad0b
ZLoader
c247aa8ff45f67b7bd2786ddd906fd1500a445364a8074b8320ca2dc179dc5be
ZLoader
c5a07a557082018c4b3526b12e681182d7e489ce22e90c2b4f68feae5f93d4d0
ZLoader
d56060acb8115119810ae3aca151e94cbe5e2459dd405c8f010ced5a25c8548a
ZLoader
Result
Malware family:
zloader
Create hunting rule
Score:
  10/10
Tags:
family:zloader botnet:nut campaign:04/02 botnet trojan
Link:
https://tria.ge/reports/210205-ksf1qv175j/
Behaviour
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Suspicious use of SetThreadContext
Blocklisted process makes network request
Zloader, Terdot, DELoader, ZeusSphinx
Malware Config
C2 Extraction:
https://vidhyashram.edu.in/post.php
https://carmeta-ampuh.com/post.php
https://bestarticleblog.com/post.php
https://alahsateam.com/post.php
https://pyggroup.com.pe/post.php
https://perlisisacsiograv.tk/post.php
Unpacked files
SH256 hash:
3b3bf8030dbda7b4c12d965928bce68ed15341fa9d91ea4489ad3ca7aad6614d
MD5 hash:
6d72546fbb7cae443a46d6a744760f7e
SHA1 hash:
c4d715bd92f12d54c2a77e5c1ac1ef1a2d1957f5
Detections:
win_zloader_auto
Create hunting rule
Link:
https://www.unpac.me/results/a0f22cca-e9c3-4ff2-b78d-f0562b954313/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/3b3bf8030dbda7b4c12d965928bce68ed15341fa9d91ea4489ad3ca7aad6614d

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:win_zloader_auto
Create hunting rule
Author:Felix Bilstein - yara-signator at cocacoding dot com
Description:autogenerated rule brought to you by yara-signator
Rule name:Zloader
Create hunting rule
Author:kevoreilly
Description:Zloader Payload

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

ZLoader

DLL dll 3b3bf8030dbda7b4c12d965928bce68ed15341fa9d91ea4489ad3ca7aad6614d

(this sample)

  
X
https://twitter.com/ffforward/status/1357733709005410304
  
Delivery method
Distributed via e-mail attachment
Cape
Cape
https://www.capesandbox.com/analysis/115854/

Comments