🤲🏼 NEW | abuse.ch Community Hub! Earn recognition 🏅 for the malware intelligence you share, climb the leaderboards 📈, and connect with like-minded contributors who share your hunting focus 🤝. Ready to unlock your profile? Go to the Community Hub →

MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 63f29f078acebb36b44d7875c4a54ec051736481ee85898a2ad7e28e2fe1dc08. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


ZLoader


Vendor detections: 9


Intelligence 9 IOCs YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 63f29f078acebb36b44d7875c4a54ec051736481ee85898a2ad7e28e2fe1dc08
SHA3-384 hash: 71fe25bef48180d7c6a826b4c107962bcdade818e83af4b46d50aa1678a21351f473e9382e9220fdd49635eeef30339f
SHA1 hash: 2a41fdcb1e82af69fc6c41d572039204b16e43dd
MD5 hash: 388cc3b6cd3ae537f404e235556d78ad
humanhash: saturn-bulldog-pip-minnesota
File name:nocrypt.dll
Download: download sample
Signature ZLoader
Create hunting rule
File size:159'744 bytes
First seen:2020-08-28 05:17:31 UTC
Last seen:2020-08-28 05:44:02 UTC
File type:DLL dll
MIME type:application/x-dosexec
imphash dc6bb9ad515f0c6d66b3c1eefe606d5f (1 x ZLoader)
ssdeep 3072:V9mVUDJBy5QVXLxGlUh355or+xneeMFRaWX7GYcPi5:32UDJBlx3hfLxnVMn7LGP4
Threatray 4 similar samples on MalwareBazaar
TLSH BDF3070254648534F9410071659EE7BE9D6EC32E3B129AEBCB91CCF09FDC6E0A6BD21D
Reporter threathive
Tags:ZLoader

Intelligence

File Origin
# of uploads :
2
# of downloads :
96
Origin country :
n/a
Vendor Threat Intelligence
Detection:
Zloader
Create hunting rule
Link:
https://www.capesandbox.com/analysis/52154/
Detection(s):
SecuriteInfo.com.Variant.Razy.607405.18403.17062.UNOFFICIAL
Create hunting rule

Result
Verdict:
Clean
Maliciousness:

Behaviour
Sending a UDP request
Launching a process
Result
Threat name:
TightVNC ZLoader
Create hunting rule
Detection:
malicious
Classification:
troj.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/453173
Signature
Allocates memory in foreign processes
Contains functionality to inject code into remote processes
Contains VNC / remote desktop functionality (version string found)
Injects a PE file into a foreign processes
Injects code into the Windows Explorer (explorer.exe)
Multi AV Scanner detection for dropped file
Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)
Uses ipconfig to lookup or modify the Windows network settings
Uses net.exe to modify the status of services
Writes to foreign memory regions
Yara detected TightVNC
Yara detected ZLoader
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 278956 Sample: nocrypt.dll Startdate: 28/08/2020 Architecture: WINDOWS Score: 100 46 cdn.onenote.net 2->46 60 Snort IDS alert for network traffic (e.g. based on Emerging Threat rules) 2->60 62 Multi AV Scanner detection for dropped file 2->62 64 Yara detected ZLoader 2->64 66 4 other signatures 2->66 11 loaddll32.exe 1 2->11         started        signatures3 process4 process5 13 regsvr32.exe 11->13         started        16 cmd.exe 1 11->16         started        signatures6 76 Contains functionality to inject code into remote processes 13->76 78 Writes to foreign memory regions 13->78 80 Allocates memory in foreign processes 13->80 18 msiexec.exe 2 35 13->18         started        23 iexplore.exe 11 83 16->23         started        process7 dnsIp8 48 thegamegolfmagazine.com 193.141.3.70, 49776, 80 STRATOSTRATOAGDE Germany 18->48 50 truvaluconsulting.com 66.96.162.139, 49778, 80 BIZLAND-SDUS United States 18->50 52 2 other IPs or domains 18->52 44 C:\Users\user\AppData\...\hatebuta.dll, PE32 18->44 dropped 68 Injects code into the Windows Explorer (explorer.exe) 18->68 70 Writes to foreign memory regions 18->70 72 Allocates memory in foreign processes 18->72 74 Injects a PE file into a foreign processes 18->74 25 cmd.exe 1 18->25         started        27 cmd.exe 1 18->27         started        29 explorer.exe 18->29 injected 31 iexplore.exe 5 151 23->31         started        file9 signatures10 process11 dnsIp12 34 net.exe 1 25->34         started        36 conhost.exe 25->36         started        38 ipconfig.exe 1 27->38         started        40 conhost.exe 27->40         started        54 img.img-taboola.com 31->54 56 edge.gycpi.b.yahoodns.net 87.248.118.23, 443, 49746, 49747 YAHOO-DEBDE United Kingdom 31->56 58 11 other IPs or domains 31->58 process13 process14 42 net1.exe 1 34->42         started       
Detection:
zloader
Create hunting rule
Link:
https://mwdb.cert.pl/sample/63f29f078acebb36b44d7875c4a54ec051736481ee85898a2ad7e28e2fe1dc08/
Threat name:
Win32.Trojan.ZLoader
Create hunting rule
Status:
Malicious
First seen:
2020-08-28 05:19:06 UTC
AV detection:
20 of 29 (68.97%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=mpzj6b4kz25tnncnpb24jjkoybixgzeb52cytcrk27ri4l7b3qea._file
Verdict:
malicious
Label(s):
zloader
Create hunting rule
Similar samples:
3712c1a9e9ab864ee28897d0802179db4a2f664f61629f1154437640be377530
ZLoader
4791583dcb3bf93991815acc2345ff22c76e192647d5e1cd21056cd314966f93
ZLoader
addc39012bef78e54cb55e815b64c3ff93688e9925554b412a9247179faec943
ZLoader
eecaf5677c5c21d268261eef35a819549dda3c454e9b60e368070aa3bfd2f54c
ZLoader
Result
Malware family:
zloader
Create hunting rule
Score:
  10/10
Tags:
family:zloader
Link:
https://tria.ge/reports/200828-qdptx5mqma/
Behaviour
Zloader family
Malware Config
C2 Extraction:
https://girldowcahohorme.tk/wp-parsing.php
http://thegamegolfmagazine.com/wp-parsing.php
http://truvaluconsulting.com/wp-parsing.php
https://blog2.textbookrush.com/wp-parsing.php
https://curiosidadez.com.br/wp-parsing.php
https://nonchothetohear.cf/wp-parsing.php
https://sicupira8.com.br/wp-parsing.php
https://titaniumgamers.com/wp-parsing.php
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Nymaim
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/63f29f078acebb36b44d7875c4a54ec051736481ee85898a2ad7e28e2fe1dc08

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:win_zloader_auto
Create hunting rule
Author:Felix Bilstein - yara-signator at cocacoding dot com
Description:autogenerated rule brought to you by yara-signator

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

ZLoader

DLL dll 63f29f078acebb36b44d7875c4a54ec051736481ee85898a2ad7e28e2fe1dc08

(this sample)

  
Link
http://152.89.216.155/nocrypt.dll
  
Delivery method
Distributed via web download
Cape
Cape
https://www.capesandbox.com/analysis/52154/
  
URLhaus
https://urlhaus.abuse.ch/url/445813/

Comments