MalwareBazaar Database
You are currently viewing the MalwareBazaar entry for SHA256 5f7322f79d8ce25a52aadf16b3f068169990cda606fb287d74fd5957c250c3b5. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.
Database Entry
ZLoader
Vendor detections: 7
| SHA256 hash: | 5f7322f79d8ce25a52aadf16b3f068169990cda606fb287d74fd5957c250c3b5 |
|---|---|
| SHA3-384 hash: | 8bb97f071ee3f1a26bcac0bad077b273e5e93094b5e388d541a99684cdb7405bcc6a5f6424859fbcaddb225f1222fed1 |
| SHA1 hash: | edcadd564cd6ef074655165ae572af2a1ba6ef6e |
| MD5 hash: | 2e765a8048bcd67f293f11db938e77c3 |
| humanhash: | friend-aspen-skylark-india |
| File name: | 2e765a8048bcd67f293f11db938e77c3 |
| Download: | download sample |
| Signature | ZLoader |
| File size: | 85'929 bytes |
| First seen: | 2021-06-24 09:48:19 UTC |
| Last seen: | Never |
| File type: |  exe |
| MIME type: | application/x-dosexec |
| imphash | 378c4792225854c10b4a5f5d67ecdbd2 (2 x ZLoader, 1 x Adware.PushWare, 1 x Adware.Generic) |
| ssdeep | 1536:lTViOcRUBWC2jZP2ITQX5+e7ZnbHJNvgKWEJ4AZD6nm3ZjayurLT:lTUOPWC/IUJtZnbHJGc4w6m3ZjayILT |
| Threatray | 4 similar samples on MalwareBazaar |
| TLSH | 8283D01662E0E4FBC5A29F300A7A2F7A7BFAA715116503136BB09F8DBD177878C1D181 |
| Reporter |  zbetcheckin |
| Tags: | 32 exe ZLoader |
Intelligence
File Origin
# of uploads :
1
# of downloads :
174
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
2e765a8048bcd67f293f11db938e77c3
Verdict:
No threats detected
Analysis date:
2021-06-24 09:49:33 UTC
Tags:
n/a
Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Detection(s):
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
Palevo
Verdict:
Malicious
Result
Threat name:
Unknown
Detection:
malicious
Classification:
rans.evad
Score:
100 / 100
Signature
Antivirus detection for dropped file
Antivirus detection for URL or domain
Contain functionality to detect virtual machines
Contains functionality to infect the boot sector
Detected unpacking (creates a PE file in dynamic memory)
Found evasive API chain (trying to detect sleep duration tampering with parallel thread)
Machine Learning detection for dropped file
Machine Learning detection for sample
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Query firmware table information (likely to detect VMs)
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Uses schtasks.exe or at.exe to add and modify task schedules
Writes many files with high entropy
Behaviour
Behavior Graph:
Threat name:
Win32.Trojan.Strictor
Status:
Malicious
First seen:
2021-06-24 09:49:14 UTC
AV detection:
24 of 28 (85.71%)
Threat level:
5/5
Verdict:
unknown
Similar samples:
Result
Malware family:
zloader
Score:
10/10
Tags:
family:dcrat family:zloader bootkit botnet discovery evasion infostealer persistence rat spyware stealer trojan vmprotect
Behaviour
Checks processor information in registry
Creates scheduled task(s)
Enumerates system info in registry
Modifies Internet Explorer settings
Modifies data under HKEY_USERS
Modifies registry class
Modifies system certificate store
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: LoadsDriver
Suspicious use of AdjustPrivilegeToken
Suspicious use of FindShellTrayWindow
Suspicious use of SendNotifyMessage
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Program crash
Drops file in Program Files directory
Drops file in Windows directory
Launches sc.exe
Drops file in System32 directory
Checks installed software on the system
Checks whether UAC is enabled
Drops Chrome extension
Maps connected drives based on registry
Writes to the Master Boot Record (MBR)
Checks computer location settings
Loads dropped DLL
Reads user/profile data of web browsers
Creates new service(s)
Downloads MZ/PE file
Executes dropped EXE
Modifies Installed Components in the registry
Modifies Windows Firewall
Sets DLL path for service in the registry
VMProtect packed file
DcRat
Modifies system executable filetype association
Registers COM server for autorun
Zloader, Terdot, DELoader, ZeusSphinx
Unpacked files
SH256 hash:
2d5d89025911e2e273f90f393624be4819641dbee1606de792362e442e54612f
MD5 hash:
2b342079303895c50af8040a91f30f71
SHA1 hash:
b11335e1cb8356d9c337cb89fe81d669a69de17e
SH256 hash:
393b83eea1a26874e0148e2609438f05fb59cd3172509c6c1a356e25c3b4fb17
MD5 hash:
2b2ce6a4724773710667d8e892b8d71e
SHA1 hash:
bc497b829d52d0bca139e7db9792b58a6c5ccac2
SH256 hash:
dc4da2ccadb11099076926b02764b2b44ad8f97cd32337421a4cc21a3f5448f3
MD5 hash:
00a0194c20ee912257df53bfe258ee4a
SHA1 hash:
d7b4e319bc5119024690dc8230b9cc919b1b86b2
SH256 hash:
fd0e8be2135f3d326b65520383a3468c3983fa32c9c93594d986b16709d80f28
MD5 hash:
254f13dfd61c5b7d2119eb2550491e1d
SHA1 hash:
5083f6804ee3475f3698ab9e68611b0128e22fd6
SH256 hash:
5f7322f79d8ce25a52aadf16b3f068169990cda606fb287d74fd5957c250c3b5
MD5 hash:
2e765a8048bcd67f293f11db938e77c3
SHA1 hash:
edcadd564cd6ef074655165ae572af2a1ba6ef6e
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
File information
The table below shows additional information about this malware sample such as delivery method and external references.
Web download
Delivery method
Distributed via web download
Comments
Login required
You need to login to in order to write a comment. Login with your abuse.ch account.