MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 607a091d00b4660179f3b9c85bf1cd66edf3a2bc6bfcd794e60030b67363464c. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


ZLoader


Vendor detections: 9


Intelligence 9 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 607a091d00b4660179f3b9c85bf1cd66edf3a2bc6bfcd794e60030b67363464c
SHA3-384 hash: a4f46db6f8c9fdf2207b26f03dac3d0c2d7b5f1875c630afa76700ddb88ee6a5babb54f7051ef77e1f0ece3131e3afe0
SHA1 hash: 0b85e55d662fc7f87c142250ffa54a52eb3df3cb
MD5 hash: 08fb0dfc406671b03c9c9b8f39238321
humanhash: texas-wyoming-steak-lion
File name:microsoft_shared.tmp
Download: download sample
Signature ZLoader
Create hunting rule
File size:377'912 bytes
First seen:2021-03-20 02:53:19 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash 4ad973f7583abd26d0a3f65743288733 (1 x ZLoader)
ssdeep 6144:Pc31InTZCWrDic8h++Pb/hKbVI3Y/lfUpGlL9lY/2s8/tXU:0lMTZX98hZmI3YNf8mL9a/3f
Threatray 70 similar samples on MalwareBazaar
TLSH 5D84AE9A9198D6A1F703C1780B3906EB365CF6391AB425DEE20F78CAD50077167E7F82
Reporter nao_sec
Tags:Malsmoke ZLoader

Intelligence

File Origin
# of uploads :
1
# of downloads :
260
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
https://hdpornomania.com/be/
Verdict:
Malicious activity
Analysis date:
2021-03-20 02:46:42 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/647c514c-695d-4b5f-8512-71d8ad486074

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
Zloader
Create hunting rule
Link:
https://www.capesandbox.com/analysis/125740/
Detection(s):
SecuriteInfo.com.Mal.Generic-S.9552.14179.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a file in the %temp% directory
Delayed reading of the file
Delayed writing of the file
Result
Verdict:
UNKNOWN
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/06953fb7-530f-4ca0-abfd-e5d71c613428
Result
Threat name:
Unknown
Detection:
malicious
Classification:
n/a
Score:
56 / 100
Link:
https://www.joesandbox.com/analysis/646717
Signature
Machine Learning detection for sample
Multi AV Scanner detection for submitted file
PE file has a writeable .text section
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 372326 Sample: microsoft_shared.tmp Startdate: 20/03/2021 Architecture: WINDOWS Score: 56 27 Multi AV Scanner detection for submitted file 2->27 29 Machine Learning detection for sample 2->29 31 PE file has a writeable .text section 2->31 8 loaddll32.exe 1 2->8         started        process3 process4 10 cmd.exe 1 8->10         started        12 rundll32.exe 1 8->12         started        14 regsvr32.exe 8->14         started        process5 16 iexplore.exe 2 84 10->16         started        process6 18 iexplore.exe 5 153 16->18         started        dnsIp7 21 tls13.taboola.map.fastly.net 151.101.1.44, 443, 49738, 49739 FASTLYUS United States 18->21 23 geolocation.onetrust.com 104.20.184.68, 443, 49726, 49727 CLOUDFLARENETUS United States 18->23 25 8 other IPs or domains 18->25
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/607a091d00b4660179f3b9c85bf1cd66edf3a2bc6bfcd794e60030b67363464c/
Threat name:
Win32.Trojan.Wacatac
Create hunting rule
Status:
Malicious
First seen:
2021-03-20 02:54:07 UTC
AV detection:
11 of 47 (23.40%)
Threat level:
  5/5
Verdict:
malicious
Label(s):
zloader
Create hunting rule
Similar samples:
0d1774171175d150cc859a71fc56cd6a8132c9c679d3bd5c7f065126ed2a071e
ZLoader
3f1f00054377124affd8fb24f61b9a670858cc44282ffcf0341907f9dbcf1d51
ZLoader
481af12b4e027b76b68c817c3cb806291f52042d3b5dce2e9f073408f596e206
ZLoader
8895213de00492d3755473bdc57627cdd9d90189b043f2a3dc7ae948d589eb1d
ZLoader
959a3cd5e58c2bbbb4a5179e658f6193fd6cf8d5d5384b4e6dca12fa7cbc2c74
ZLoader
a7f441793b5703b349ebb2509b6af1cdfdd8023d8e56f1f9a57b9d74e69bd9a9
ZLoader
b250b1ccb8194ce1ccc86b4a88bd7279f6804fac990758e95d203fdd1d97dcc2
ZLoader
cbf6848b72b118e090953347982de71cfe1510dfdc4affdb1ee4d5d62af428d6
ZLoader
dbc2e7788019f8b0959377fa9e0f3d41d0db82445799721d1d77c583ac793e9a
ZLoader
f1b22c0b6c144d82a0e470b2c6a649135a4f212ade39c8135e0273ec100ff34c
ZLoader
+ 60 additional samples on MalwareBazaar
Result
Malware family:
zloader
Create hunting rule
Score:
  10/10
Tags:
family:zloader botnet:personal campaign:personal botnet trojan
Link:
https://tria.ge/reports/210320-qpfkl7fx3a/
Behaviour
Suspicious use of WriteProcessMemory
Zloader, Terdot, DELoader, ZeusSphinx
Malware Config
C2 Extraction:
https://iqowijsdakm.com/gate.php
https://wiewjdmkfjn.com/gate.php
https://dksaoidiakjd.com/gate.php
https://iweuiqjdakjd.com/gate.php
https://yuidskadjna.com/gate.php
https://olksmadnbdj.com/gate.php
https://odsakmdfnbs.com/gate.php
https://odsakjmdnhsaj.com/gate.php
https://odjdnhsaj.com/gate.php
https://odoishsaj.com/gate.php
Unpacked files
SH256 hash:
607a091d00b4660179f3b9c85bf1cd66edf3a2bc6bfcd794e60030b67363464c
MD5 hash:
08fb0dfc406671b03c9c9b8f39238321
SHA1 hash:
0b85e55d662fc7f87c142250ffa54a52eb3df3cb
Link:
https://www.unpac.me/results/e636ddc8-5712-47ad-92a2-e01fb55ec095/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/607a091d00b4660179f3b9c85bf1cd66edf3a2bc6bfcd794e60030b67363464c

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

ZLoader

Microsoft Software Installer (MSI) msi 90394647034a0ebfcce39fb61261e2df0cfeddbcc9359cd432e6d800e6af3da6

ZLoader

Executable exe 607a091d00b4660179f3b9c85bf1cd66edf3a2bc6bfcd794e60030b67363464c

(this sample)

  
X
https://twitter.com/nao_sec/status/1373105146499010564
  
Dropped by
SHA256 90394647034a0ebfcce39fb61261e2df0cfeddbcc9359cd432e6d800e6af3da6
  
Delivery method
Distributed via web download
Cape
Cape
https://www.capesandbox.com/analysis/125740/

Comments