MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 409c0fdd23e87d2181aed6a283d83cdeaa1b7fbb685df01b5358febb0d09c8b8. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


ZLoader


Vendor detections: 7


Maldoc score: 5


Intelligence 7 IOCs YARA 15 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 409c0fdd23e87d2181aed6a283d83cdeaa1b7fbb685df01b5358febb0d09c8b8
SHA3-384 hash: 5706bf877749d07056fe66b265562fdeb4994b150b37fa87bf97dd5c9d76ad75747b898e5177c34261b8b807d1d7151f
SHA1 hash: 3278e15e1761100b6e9bb98b2351594aebd3805d
MD5 hash: b5487815da8e8e15cfa3d2946f4b7132
humanhash: network-twelve-papa-edward
File name:39831.xls
Download: download sample
Signature ZLoader
Create hunting rule
File size:59'392 bytes
First seen:2021-03-01 16:57:25 UTC
Last seen:2021-03-01 19:05:16 UTC
File type:Excel file xls
MIME type:application/vnd.ms-excel
ssdeep 1536:kxk3hbdlylKsgqopeJBWhZFGkE+cL2NdApkOkPd+mtVs2aLuv344hmVA0gc1tiks:kxk3hbdlylKsgqopeJBWhZFGkE+cL2NT
TLSH 9B4330F6AF674DB5C5048F708CE607645312EC219A261F8367E0B628FFB7F91AB05186
Reporter ffforward
Tags:Loader ZLoader

Office OLE Information

This malware samples appears to be an Office document. The following table provides more information about this document using oletools and oledump.

OLE id
Maldoc score: 5
Application name is Microsoft Excel
Office document is in OLE format
OLE dump

MalwareBazaar was able to identify 3 sections in this file using oledump:

Section IDSection sizeSection name
14096 bytesDocumentSummaryInformation
24096 bytesSummaryInformation
349624 bytesWorkbook
OLE vba

MalwareBazaar was able to extract and deobfuscate VBA script(s) the following information from OLE objects embedded in this file using olevba:

TypeKeywordDescription
AutoExecAuto_OpenRuns when the Excel Workbook is opened
SuspiciousHex StringsHex-encoded strings were detected, may be used to obfuscate strings (option --decode to see all)
SuspiciousBase64 StringsBase64-encoded strings were detected, may be used to obfuscate strings (option --decode to see all)

Intelligence

File Origin
# of uploads :
2
# of downloads :
178
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
39831.xls
Verdict:
No threats detected
Analysis date:
2021-03-01 16:58:43 UTC
Tags:
macros macros40
Link:
https://app.any.run/tasks/07701388-954b-4cc6-9770-4d7e3ae219c1

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Verdict:
Malicious
File type:
application/vnd.ms-excel
Has a screenshot:
False
Contains macros:
True
Detection(s):
TwinWave.EvilDoc.Excel4.BlackSubmarines.2020.UNOFFICIAL
Create hunting rule

TwinWave.EvilDoc.Excel4MacroLuresWatchingTheDectives.20210115.UNOFFICIAL
Create hunting rule

TwinWave.EvilDoc.ZloaderGasPanic.20210216.UNOFFICIAL
Create hunting rule

Result
Verdict:
Clean
Maliciousness:

Behaviour
Creating a window
Result
Verdict:
Malicious
File Type:
Legacy Office File
Link:
https://app.docguard.net/409c0fdd23e87d2181aed6a283d83cdeaa1b7fbb685df01b5358febb0d09c8b8/results/dashboard
Result
Verdict:
MALICIOUS
Details
Excel 4.0 Macro
Document contains Excel 4.0 macros (XLM). A valid, albeit dated feature, this document should be treated with suspicion.
Autostarting Excel Macro Sheet
Excel contains Macrosheet logic that will trigger automatically upon document open.
Result
Threat name:
Hidden Macro 4.0
Create hunting rule
Detection:
malicious
Classification:
evad
Score:
56 / 100
Link:
https://www.joesandbox.com/analysis/622580
Signature
Found abnormal large hidden Excel 4.0 Macro sheet
Hides that the sample has been downloaded from the Internet (zone.identifier)
Multi AV Scanner detection for submitted file
Behaviour
Behavior Graph:
Download SVG
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/409c0fdd23e87d2181aed6a283d83cdeaa1b7fbb685df01b5358febb0d09c8b8/
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=icoa7xjd5b6sdano22rihwb432vbw753nbo7ag2tld7lwdijzc4a._file
Result
Malware family:
n/a
Score:
  8/10
Tags:
macro xlm
Link:
https://tria.ge/reports/210301-2aqemcsxcn/
Behaviour
Checks processor information in registry
Enumerates system info in registry
Modifies Internet Explorer settings
Suspicious behavior: AddClipboardFormatListener
Suspicious behavior: GetForegroundWindowSpam
Suspicious use of SetWindowsHookEx
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/409c0fdd23e87d2181aed6a283d83cdeaa1b7fbb685df01b5358febb0d09c8b8

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:ach_ZLoader_xls_20201029
Create hunting rule
Author:abuse.ch
Description:Detects ZLoader XLS
Rule name:ach_ZLoader_xls_20210125
Create hunting rule
Author:abuse.ch
Description:Detects ZLoader XLS
Rule name:Email_stealer_bin_mem
Create hunting rule
Author:James_inthe_box
Description:Email in files like avemaria
Rule name:enterpriseapps
Create hunting rule
Author:Tim Brown @timb_machine
Description:Enterprise apps
Rule name:enterpriseunix
Create hunting rule
Author:Tim Brown @timb_machine
Description:Enterprise UNIX
Rule name:INDICATOR_DOC_PhishingPatterns
Create hunting rule
Author:ditekSHen
Description:Detects OLE, RTF, PDF and OOXML (decompressed) documents with common phishing strings
Rule name:IPPort_combo_mem
Create hunting rule
Author:James_inthe_box
Description:IP and port combo
Rule name:Select_from_enumeration
Create hunting rule
Author:James_inthe_box
Description:IP and port combo
Rule name:SharedStrings
Create hunting rule
Author:Katie Kleemola
Description:Internal names found in LURK0/CCTV0 samples
Rule name:SUSP_EnableContent_String_Gen
Create hunting rule
Author:Florian Roth
Description:Detects suspicious string that asks to enable active content in Office Doc
Reference:Internal Research
Rule name:UAC_bypass_bin_mem
Create hunting rule
Author:James_inthe_box
Description:UAC bypass in files like avemaria
Rule name:ZloaderXLSBehavior
Create hunting rule
Rule name:ZloaderXLSInvoice
Create hunting rule

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

ZLoader

Excel file xls 409c0fdd23e87d2181aed6a283d83cdeaa1b7fbb685df01b5358febb0d09c8b8

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/1040694/
  
Delivery method
Distributed via web download

Comments