MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 7d5ef8e6c5738ebc13718eee67f0b6cc354f3e28b135e4a378f69d57043299b8. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


ZLoader


Vendor detections: 5


Intelligence 5 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 7d5ef8e6c5738ebc13718eee67f0b6cc354f3e28b135e4a378f69d57043299b8
SHA3-384 hash: fd720a298538e2b15bb4521a4c8feea210ac777254270a92afafd4f31199cc9fbcd8d4161e03bb7e9368c24eced3c959
SHA1 hash: f342f7b0b49526047ef80e8fa916ea4c7afefacd
MD5 hash: 3188d2f01ddf123f02b626c390886f66
humanhash: river-violet-pip-georgia
File name:2.dll
Download: download sample
Signature ZLoader
Create hunting rule
File size:816'128 bytes
First seen:2020-05-12 16:47:38 UTC
Last seen:2020-07-19 19:31:43 UTC
File type:DLL dll
MIME type:application/x-dosexec
imphash 001652b58a9526749c2429448fdad35a (1 x ZLoader)
ssdeep 24576:OJjx/uzRjsyqSk+1PgStj/OU7nsMsiPas8nUQ0jbTAoWeI:OOjsyqj+BZk0aeI
Threatray 766 similar samples on MalwareBazaar
TLSH D5058C103389D175E57A0B314C32D5F444AABE19DF32995F72E93F0FAA756808A39B0B
Reporter James_inthe_box
Tags:dll ZLoader

Intelligence

File Origin
# of uploads :
3
# of downloads :
113
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
PUA.Win.Packer.PrivateExeProte-11
Create hunting rule

PUA.Win.Downloader.Aiis-6803892-0
Create hunting rule

Gathering data
Threat name:
Win32.Trojan.Zloader
Create hunting rule
Status:
Malicious
First seen:
2020-05-12 16:47:05 UTC
File Type:
PE (Dll)
Extracted files:
1
AV detection:
22 of 31 (70.97%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=pvpprzwfoohlye3rr3xgp4fwzq2u6priwe26ji3y62ovobbstg4a._file
Verdict:
malicious
Label(s):
zloader
Create hunting rule
gozi
Create hunting rule
Similar samples:
1267b822cde1edabfc063458232a5ed9ea03652416de96b8d12ecb1058c86e23
ZLoader
346b977e05b99881c7ec168c2fa0b68f84ec633d764eb52dd9795e372f45b1b4
ZLoader
34fd926b213a1c5726124dff74dbf69c731f8e823168d17cc1c9448501ed314f
ZLoader
385be4267e9aaadfb82815d54dde7fccbd0d1b843aa3c4062ef752a9378ae02e
ZLoader
6593fa326b8eb0b737a17889c50c539ac45f2f9215fdab50ffa62df1be7ec2d1
ZLoader
692c58e28e0f0346adfbad2356dd8495ec8f07718ee40db171b50e8870526f96
ZLoader
abe31666e7b408ed139ba7452f70d3f633b7cc7ce0de9de8b8c6489f47a34df8
ZLoader
cc32eb0fb5c35376f69a3d6b81fdb339309d06d80a2cffa2604e21012ac33c18
ZLoader
ccf1e6416673f50f016cfa1658e9dd29793195b9bc701fedc1218d122faeb6b2
ZLoader
e4093649633b05316196a275bd0845829d0e9a63a78943977f96770b3e74a7f1
ZLoader
+ 756 additional samples on MalwareBazaar
Result
Malware family:
zloader
Create hunting rule
Score:
  10/10
Tags:
family:zloader botnet:12/05 botnet trojan
Link:
https://tria.ge/reports/201109-lgb3mvfese/
Behaviour
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Suspicious use of SetThreadContext
Zloader, Terdot, DELoader, ZeusSphinx
Malware Config
C2 Extraction:
https://japanjisho.info/wp-parser.php
https://home.comegico.com.mx/wp-parser.php
https://hormonas.comegico.com.mx/wp-parser.php
https://hopime.com/wp-parser.php
https://gavrelets.ru/wp-parser.php
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

  
Delivery method
Other
  
URLhaus
https://urlhaus.abuse.ch/url/361693/

Comments