MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 3c983bfb316b633fa71608b49f7aae4968a71d0178aef4733a86bfc99dd41f23. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


ZLoader


Vendor detections: 7


Intelligence 7 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 3c983bfb316b633fa71608b49f7aae4968a71d0178aef4733a86bfc99dd41f23
SHA3-384 hash: 177a85ea4bcb56cc72d7c5b0d9f7a289032f7065ba04d3efe165aae270e16a9f84139b52a155794a5a4555ffc07f55ff
SHA1 hash: 2343a17b2eb54695ecdd883e256c29600a0410f6
MD5 hash: 39fea8f884f547624ec9cc4dc384796b
humanhash: illinois-avocado-mango-salami
File name:3c983bfb316b633fa71608b49f7aae4968a71d0178aef4733a86bfc99dd41f23
Download: download sample
Signature ZLoader
Create hunting rule
File size:615'424 bytes
First seen:2021-10-06 01:17:51 UTC
Last seen:2021-10-06 01:53:32 UTC
File type:DLL dll
MIME type:application/x-dosexec
imphash 1f34e682a47b6dbe0d655e2692f4c875 (1 x ZLoader)
ssdeep 12288:VmqS1/arnXN1IE5UCfpPI+kJBl5b+g3wB5x4cSpQ3:VO4N1IANpw+8p+95xP3
Threatray 54 similar samples on MalwareBazaar
TLSH T185D4DF1376D3C1B2D17E49314960D9E60A6CBE114F245EEB37E83F6F0E351C28A35AA6
Reporter tildedennis
Tags:dll ZLoader zloader 2


Avatar
tildedennis
zloader 2 version 2.0.0.0

Intelligence

File Origin
# of uploads :
2
# of downloads :
219
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/195220/
Detection(s):
SecuriteInfo.com.Variant.Babar.28762.14806.12636.UNOFFICIAL
Create hunting rule

Result
Verdict:
Clean
Maliciousness:

Behaviour
Creating a window
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
greyware
Link:
https://www.filescan.io/uploads/615cf94d98a6280f3932a0b4/reports/dae4a4e1-d088-46f1-9c3f-03e66886c172/overview
Malware family:
Zloader
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/30e5e1f2-29dc-4d20-86ce-33e52a5922ac
Result
Threat name:
ZLoader
Create hunting rule
Detection:
malicious
Classification:
troj
Score:
68 / 100
Link:
https://www.joesandbox.com/analysis/865168
Signature
C2 URLs / IPs found in malware configuration
Found malware configuration
Multi AV Scanner detection for submitted file
Yara detected ZLoader
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 497596 Sample: I6EL5U2xmJ Startdate: 06/10/2021 Architecture: WINDOWS Score: 68 20 314xd.com/post.php unknown unknown 2->20 22 beta.marlics.ir/post.php unknown unknown 2->22 24 8 other IPs or domains 2->24 26 Found malware configuration 2->26 28 Multi AV Scanner detection for submitted file 2->28 30 Yara detected ZLoader 2->30 32 C2 URLs / IPs found in malware configuration 2->32 8 loaddll32.exe 1 2->8         started        signatures3 process4 process5 10 cmd.exe 1 8->10         started        12 rundll32.exe 8->12         started        14 rundll32.exe 8->14         started        16 rundll32.exe 8->16         started        process6 18 rundll32.exe 10->18         started       
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/3c983bfb316b633fa71608b49f7aae4968a71d0178aef4733a86bfc99dd41f23/
Threat name:
Win32.Downloader.Zload
Create hunting rule
Status:
Malicious
First seen:
2021-09-16 03:06:02 UTC
AV detection:
13 of 28 (46.43%)
Threat level:
  3/5
Verdict:
malicious
Label(s):
zloader
Create hunting rule
gozi
Create hunting rule
Similar samples:
0f527546d025e3705bdbba6eb98226373a8b8368bd1d2915a5f195541566d11e
ZLoader
3f1f00054377124affd8fb24f61b9a670858cc44282ffcf0341907f9dbcf1d51
ZLoader
4b0c5b4530a9218d6030a7040a10ea5be84ffa3696601732ee7212691521474f
ZLoader
7ba99f8f77a2e660f1837cad9d169ccf892154da5b2651e4e6e66efddd61944c
ZLoader
89e83ef4b109f38ef1f9d8dd2ab6005426e2f24c5cf106717af3eb2bdb69c78e
ZLoader
c4ab81d7b7d44dd6dfc4f2b69dbe3f22fbf23c1ae49ab8edac2d26f85ae4514d
ZLoader
dbc2e7788019f8b0959377fa9e0f3d41d0db82445799721d1d77c583ac793e9a
ZLoader
e6e972d93f6d8d1dbb56f41027614d7738bbe73d9a8cc65de8b06da666440ae5
ZLoader
edaabcb2e82b51c9b8df54dc82afc494bff804b1b187c4657ab583e8ca0bd052
ZLoader
edb9d542cbc5ab07fd52792e20294f82b51de49c3d32938cbd9b55b2374d2b55
ZLoader
+ 44 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  1/10
Tags:
n/a
Link:
https://tria.ge/reports/211006-bny18sagbp/
Behaviour
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Unpacked files
SH256 hash:
3c983bfb316b633fa71608b49f7aae4968a71d0178aef4733a86bfc99dd41f23
MD5 hash:
39fea8f884f547624ec9cc4dc384796b
SHA1 hash:
2343a17b2eb54695ecdd883e256c29600a0410f6
Link:
https://www.unpac.me/results/87b0f98b-c355-462e-98cb-31090c086a86/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/3c983bfb316b633fa71608b49f7aae4968a71d0178aef4733a86bfc99dd41f23

File information

The table below shows additional information about this malware sample such as delivery method and external references.

  
Link
https://zeusmuseum.com/zloader 2/
Cape
Cape
https://www.capesandbox.com/analysis/195220/

Comments