MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 706db7c88184091e366e8f60d21aab5d1238ea7da9a6f97aa8c79c2cf4204e8f. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


ZLoader


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 706db7c88184091e366e8f60d21aab5d1238ea7da9a6f97aa8c79c2cf4204e8f
SHA3-384 hash: a8e6093734a19f4230dd8f954e25d5df5e96bb623725bac5085ffe6d212adca4f7b679b11d7e88e9ecfad432bbf72f96
SHA1 hash: 68a6b61455c82d55e29e15ce2790b55122166f3a
MD5 hash: e65ad3d3059a09f7c4edea0f27e6c77a
humanhash: kentucky-michigan-delaware-skylark
File name:bbc.dll
Download: download sample
Signature ZLoader
Create hunting rule
File size:484'864 bytes
First seen:2020-06-16 07:41:31 UTC
Last seen:Never
File type:DLL dll
MIME type:application/x-dosexec
imphash 8576f2eda7a30aeed43fccdbadabc440 (16 x Gozi, 10 x ZLoader)
ssdeep 12288:T2s6153w0KPnJHFlswhjmoUYtIdySZYBk:TZ8Vb8jmotI2S
Threatray 302 similar samples on MalwareBazaar
TLSH 36A4D0E25940B2B0D14BC97E9420B1B681F97C2A7F549180F98B47B735372FAA994FC3
Reporter JAMESWT_WT
Tags:ZLoader

Intelligence

File Origin
# of uploads :
1
# of downloads :
75
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/10646/
Detection(s):
SecuriteInfo.com.Trojan.DownLoader33.50034.29723.12589.UNOFFICIAL
Create hunting rule

PUA.Win.Downloader.Aiis-6803892-0
Create hunting rule

Gathering data
Threat name:
Win32.Trojan.ZLoader
Create hunting rule
Status:
Malicious
First seen:
2020-06-16 07:43:04 UTC
File Type:
PE (Dll)
Extracted files:
1
AV detection:
25 of 31 (80.65%)
Threat level:
  5/5
Verdict:
malicious
Label(s):
gozi
Create hunting rule
zloader
Create hunting rule
Similar samples:
0eb381723057cbec531c209a0b5dca273d5c05ca5832b4d7baa2447d32e861cf
ZLoader
244bd22b299305418f66c5a6239c70bdc5eced7c0464210feaac591301241cd5
ZLoader
255297eee7c72210f2ec47e978dc31759f1a8007e6de88ed59c75d370a08b844
ZLoader
3c774090ba37e891c0268796302378c8340f29c3d5dd1be52395abfd2c126bea
ZLoader
66d4f17726f5853e6127da6c02b6760f5cabbcf2793673d0db6b93517a537a78
ZLoader
6758e40ac447186fc8390e3814d81c4b90b3ec89b20c5db2b2c6ebda9d6df41e
ZLoader
8179cb45ba2d6df0d25f9e1f382c5b9e8b9b703e4404fa19a9002c78418dedea
ZLoader
8cef73774b9cbc3a63d6212cc1361b9b77c3dfc05d815730e2132535ebadaaa5
ZLoader
8dbbc783a02a103f860b387d4c62c278b47c234e5ad4331eda1ba6ed7b06194f
ZLoader
9ce2908edf0994f493926514628054634858340fb73f219c38c013f34dd9a429
ZLoader
+ 292 additional samples on MalwareBazaar
Result
Malware family:
zloader
Create hunting rule
Score:
  10/10
Tags:
trojan botnet family:zloader persistence
Link:
https://tria.ge/reports/200624-j991w3q1la/
Behaviour
Suspicious use of WriteProcessMemory
Suspicious use of AdjustPrivilegeToken
Suspicious use of SetThreadContext
Adds Run entry to start application
Blacklisted process makes network request
Zloader, Terdot, DELoader, ZeusSphinx
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

ZLoader

DLL dll 706db7c88184091e366e8f60d21aab5d1238ea7da9a6f97aa8c79c2cf4204e8f

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/385322/
  
Delivery method
Distributed via web download
Cape
Cape
https://www.capesandbox.com/analysis/10646/

Comments