MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 3bc843b534c96a38ab8f4b785f902f70dc8ebd48164aa0870562da285c49a9ec. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


ZLoader


Vendor detections: 5


Intelligence 5 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 3bc843b534c96a38ab8f4b785f902f70dc8ebd48164aa0870562da285c49a9ec
SHA3-384 hash: f840bda4d7f741197492b860200f1a8990fa76f3dc62868adfc05c42e211aadc0d86db70bb08fd154891823838a340f0
SHA1 hash: f89fc63457ce4914b5e41ed0b17af0a9e1ac6119
MD5 hash: 8bdb30d9f3c697d3f12aea9dd3d83a60
humanhash: oxygen-may-tennis-sierra
File name:senate.m4a
Download: download sample
Signature ZLoader
Create hunting rule
File size:589'312 bytes
First seen:2020-06-12 16:14:11 UTC
Last seen:2025-01-23 02:40:17 UTC
File type:DLL dll
MIME type:application/x-dosexec
imphash b830174c9e391ff1d806b76304cef839 (1 x ZLoader)
ssdeep 3072:1YkPy807G4DQRGSiZ+LwbUcsNTJiFJwjjeh2ULOgKNIfvqoaAUk/vQExVxynJf0m:FPyH7l+4sdJeJoW4gO6q2vfLxyZ
Threatray 42 similar samples on MalwareBazaar
TLSH A2C45AE5A2534857EC6E2D710EF95E037219BC70A4751BBE21DB3B4E8931D883E71A0E
Reporter threathive
Tags:spx189 ZLoader


Avatar
ThreatHive
Zloader dropped by Qakbot VBS based distribution.

Intelligence

File Origin
# of uploads :
5
# of downloads :
89
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/10080/
Detection(s):
SecuriteInfo.com.Variant.Razy.685797.24706.3954.UNOFFICIAL
Create hunting rule

Gathering data
Threat name:
Win32.Trojan.Kryptik
Create hunting rule
Status:
Malicious
First seen:
2020-06-12 16:16:07 UTC
File Type:
PE (Dll)
Extracted files:
210
AV detection:
22 of 28 (78.57%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=hpeehnjuzfvdrk4pjn4f7ebpodoi5pkiczfkbbyfmlncqxcjvhwa._file
Verdict:
malicious
Label(s):
zloader
Create hunting rule
Similar samples:
02846dbf25b333625a0720075fb47da62a946e5b0b4f9e9ba14cef514d576b37
ZLoader
1bcf9a3648bac8ded65038381f3e40a590d0e2d5ec5d3cc8bca275a2939dad17
ZLoader
29bf6be1fa9e4b72bb9e2eeb8156ea1c03311d157d1bb28a0cea1328c6fd473d
ZLoader
3712c1a9e9ab864ee28897d0802179db4a2f664f61629f1154437640be377530
ZLoader
4e14841c96a09f5850d1cf5fcb3526714c22d7174e3f75c8a309d8db36ecef93
ZLoader
b866a18458d22f3c362eb9db308ccbbe80ad1a1ef04d9f1c8ba6d3c66ccd4971
ZLoader
cb762227729d0faadc4c33a4a55b513673a9c76284773535b0e07d7e47d8413e
ZLoader
df2524f89b7247e931a13644d2c00bbc94095eb8e4755a9db2421bd46f365f7c
ZLoader
eecaf5677c5c21d268261eef35a819549dda3c454e9b60e368070aa3bfd2f54c
ZLoader
f45334733550d1ed6347c469380e55bb731def5c0c535bc81ced5a02f2cbd8ea
ZLoader
+ 32 additional samples on MalwareBazaar
Result
Malware family:
zloader
Create hunting rule
Score:
  10/10
Tags:
family:zloader botnet:spx139 campaign:spx139 botnet cryptone packer trojan
Link:
https://tria.ge/reports/201109-x98lp536tn/
Behaviour
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Suspicious use of SetThreadContext
Blacklisted process makes network request
Zloader, Terdot, DELoader, ZeusSphinx
Malware Config
C2 Extraction:
https://xeemoquo.top/treusparq.php
https://leeephee.top/treusparq.php
https://withifceale.top/treusparq.php
https://wpsnoum.pw/treusparq.php
https://wsaexdig.pw/treusparq.php
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/10080/

Comments