MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 481af12b4e027b76b68c817c3cb806291f52042d3b5dce2e9f073408f596e206. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


ZLoader


Vendor detections: 8


Intelligence 8 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 481af12b4e027b76b68c817c3cb806291f52042d3b5dce2e9f073408f596e206
SHA3-384 hash: 226c95fbdbed6c8771beda500b6ad202312de07a32c54108cdd49710c97faed807a1012094bbbeac0053eeda1dadeb47
SHA1 hash: 953610bd3f74f02f959b54c8832028404c96b8db
MD5 hash: 80be8f74f423ffd951a2a807ab5815c9
humanhash: sixteen-juliet-twelve-cat
File name:ihuwma.dll
Download: download sample
Signature ZLoader
Create hunting rule
File size:551'256 bytes
First seen:2020-10-24 09:10:42 UTC
Last seen:Never
File type:DLL dll
MIME type:application/x-dosexec
imphash ed0fb62704d599773891aefdf1981443 (1 x ZLoader)
ssdeep 6144:ECE98sDXeHfijLo9qLV+ytqG5XWZ/6anVytD5lHd:ECS6HQSm5qGQ4awP
Threatray 47 similar samples on MalwareBazaar
TLSH 5CC4C56769C3CF04DD3E40FBC5FCAAB8172182380D9D4F29E75E48B5FA574992A8026D
Reporter TrappmanRhett

Intelligence

File Origin
# of uploads :
1
# of downloads :
112
Origin country :
n/a
Vendor Threat Intelligence
Detection:
Zloader
Create hunting rule
Link:
https://www.capesandbox.com/analysis/75188/
Detection(s):
SecuriteInfo.com.Generic.mg.80be8f74f423ffd9.28568.UNOFFICIAL
Create hunting rule

Result
Verdict:
Clean
Maliciousness:

Behaviour
Sending a UDP request
Creating a file in the %temp% directory
Delayed writing of the file
Delayed reading of the file
Result
Threat name:
Unknown
Detection:
malicious
Classification:
n/a
Score:
48 / 100
Link:
https://www.joesandbox.com/analysis/508594
Signature
A
b
c
d
e
f
i
l
M
n
o
r
S
t
u
V
Behaviour
Behavior Graph:
Download SVG
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/481af12b4e027b76b68c817c3cb806291f52042d3b5dce2e9f073408f596e206/
Threat name:
Win32.Trojan.ZLoader
Create hunting rule
Status:
Malicious
First seen:
2020-10-24 09:02:35 UTC
AV detection:
23 of 28 (82.14%)
Threat level:
  5/5
Verdict:
malicious
Label(s):
zloader
Create hunting rule
Similar samples:
12e5c221195f7d0a47b98b5d5fff26ea8fc4ad4f76f1c21f47e3a73102f18c59
ZLoader
15737d37308fb5a8745afb8c34249e387bad9b1d001f2fcaa44b8c0333286861
ZLoader
2146f27b05e76eac964c664ee1e6df16679ed030305b7ebe2298a606d03cdff3
ZLoader
44ede6e1b9be1c013f13d82645f7a9cff7d92b267778f19b46aa5c1f7fa3c10b
ZLoader
49d7303aab08fdc92f4a19e794ff05b82b4286d2793cdef0f85821b7201ccacb
ZLoader
6058c6ad67825611365e2b30a4e8641f898a1f04c3d4edc4fc228ea7a5b5cb20
ZLoader
8895213de00492d3755473bdc57627cdd9d90189b043f2a3dc7ae948d589eb1d
ZLoader
89e83ef4b109f38ef1f9d8dd2ab6005426e2f24c5cf106717af3eb2bdb69c78e
ZLoader
959a3cd5e58c2bbbb4a5179e658f6193fd6cf8d5d5384b4e6dca12fa7cbc2c74
ZLoader
dbc2e7788019f8b0959377fa9e0f3d41d0db82445799721d1d77c583ac793e9a
ZLoader
+ 37 additional samples on MalwareBazaar
Result
Malware family:
zloader
Create hunting rule
Score:
  10/10
Tags:
trojan botnet family:zloader
Link:
https://tria.ge/reports/201024-brxeft3xss/
Behaviour
Suspicious use of WriteProcessMemory
Zloader, Terdot, DELoader, ZeusSphinx
Malware Config
C2 Extraction:
https://kochamkkkras.ru/gate.php
https://uookqihwdid.ru/gate.php
https://iqowijsdakm.ru/gate.php
https://wiewjdmkfjn.ru/gate.php
https://dksaoidiakjd.su/gate.php
https://iweuiqjdakjd.su/gate.php
https://yuidskadjna.su/gate.php
https://olksmadnbdj.su/gate.php
https://odsakmdfnbs.su/gate.php
https://odsakjmdnhsaj.su/gate.php
Unpacked files
SH256 hash:
2aad576a107cd5cb031c13a85f8403a3b0e377a608a1af77f6e5607295bd54eb
MD5 hash:
511430077d7201c83f2d04087b01799f
SHA1 hash:
cf60e5e61dcc0de22a4e2359cd792f9d7a733ec9
Detections:
win_zloader_auto
Create hunting rule
Link:
https://www.unpac.me/results/c4a54a76-1c6f-418d-bbbe-296525ed0976/
Parent samples :
481af12b4e027b76b68c817c3cb806291f52042d3b5dce2e9f073408f596e206
2aad576a107cd5cb031c13a85f8403a3b0e377a608a1af77f6e5607295bd54eb
SH256 hash:
481af12b4e027b76b68c817c3cb806291f52042d3b5dce2e9f073408f596e206
MD5 hash:
80be8f74f423ffd951a2a807ab5815c9
SHA1 hash:
953610bd3f74f02f959b54c8832028404c96b8db
Link:
https://www.unpac.me/results/c4a54a76-1c6f-418d-bbbe-296525ed0976/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Kryptik
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/481af12b4e027b76b68c817c3cb806291f52042d3b5dce2e9f073408f596e206

File information

The table below shows additional information about this malware sample such as delivery method and external references.

  
Delivery method
Distributed via drive-by
Cape
Cape
https://www.capesandbox.com/analysis/75188/

Comments