MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 3dd800b875aa0ef2fa0923babdd4b162555a1c3ff3c58e9291d45fff82389816. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry



ZLoader


Vendor detections: 7


Intelligence 7 IOCs YARA File information Comments

SHA256 hash: 3dd800b875aa0ef2fa0923babdd4b162555a1c3ff3c58e9291d45fff82389816
SHA3-384 hash: 929da242714ef2a99e1a3eca9c6470e428b2c390103e0920f21fcd194a548ed3327a3972b4f683e69263d255aa110bb4
SHA1 hash: fe3a1f35f5c21ce72a1ef05cbf2824a51827a5f2
MD5 hash: 004d3ff1fe0ec1d0a90913f1238f293f
humanhash: low-spaghetti-apart-speaker
File name:tfR5r4pw
Download: download sample
Signature ZLoader
File size:649'216 bytes
First seen:2020-07-02 16:15:35 UTC
Last seen:2020-07-02 17:05:49 UTC
File type:DLL dll
MIME type:application/x-dosexec
imphash a3c70c53662770049a946e3d13403827 (2 x ZLoader)
ssdeep 12288:BBLIZWDR44fZdoTz0E9z/Y20Yq+Bc2OnjOjSxchYK4/cr:fIZWy4PoT9/YJX9cE/
Threatray 106 similar samples on MalwareBazaar
TLSH 59D4AF202F92C536F6BB0B358826C5309DACBE4595F489DF53D5760E16773C280BAF1A
Reporter @JAMESWT_MHT
Tags:dll ZLoader

Intelligence


File Origin
# of uploads :
2
# of downloads :
93
Origin country :
IT IT
Mail intelligence
No data
Vendor Threat Intelligence
Threat name:
Win32.Trojan.ZLoader
Status:
Malicious
First seen:
2020-07-02 16:17:04 UTC
File Type:
PE (Dll)
Extracted files:
26
AV detection:
21 of 29 (72.41%)
Threat level:
  5/5
Result
Malware family:
zloader
Score:
  10/10
Tags:
spyware trojan botnet family:zloader persistence
Behaviour
Discovers systems in the same network
Suspicious use of AdjustPrivilegeToken
Suspicious behavior: EnumeratesProcesses
Suspicious use of WriteProcessMemory
Runs net.exe
Modifies service
Suspicious use of SetThreadContext
Reads user/profile data of web browsers
Blacklisted process makes network request
Zloader, Terdot, DELoader, ZeusSphinx
Suspicious use of NtCreateUserProcessOtherParentProcess

File information


The table below shows additional information about this malware sample such as delivery method and external references.

Comments