MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 84e360a829386b13dbf487803bc7b8a04f68b9b743ebfa3c9eea76abe00773d4. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

ZLoader

Vendor detections: 7

Intelligence 7 IOCs YARA 3 File information Comments

SHA256 hash:	84e360a829386b13dbf487803bc7b8a04f68b9b743ebfa3c9eea76abe00773d4
SHA3-384 hash:	ce441b3a6827352221c8962faed01fcaf6fefb57ff0cd036583692d10120b2f4a361968555bd443c95c666a213317a9a
SHA1 hash:	f1d680faed22c11ffcc8d103bbed2794ca1089f0
MD5 hash:	142cf09ef1d30a422dbf43803e7c1517
humanhash:	single-social-five-utah
File name:	142cf09ef1d30a422dbf43803e7c1517.dll
Download:	download sample
Signature	ZLoader Create hunting rule
File size:	668'160 bytes
First seen:	2020-10-27 14:41:37 UTC
Last seen:	Never
File type:	dll
MIME type:	application/x-dosexec
imphash	fd823cbe2a670acdaefa7c3aebf3be62 (2 x ZLoader)
ssdeep	12288:W207uPGSpCObphWIlP3D57g97xGzc7UBfk458QMtnUmLfCxdNZsgvhIlcYD:W20k1Vtdg9VrgBfk452CYg5S
Threatray	27 similar samples on MalwareBazaar
TLSH	6BE4F091BA62C47DC12E6536CD5AE8FD1629BD15DE3808E734C42F5F3E361108A3ED2A
Reporter	abuse_ch
Tags:	dll ZLoader

Intelligence

File Origin

# of uploads :

# of downloads :

Origin country :

n/a

Vendor Threat Intelligence

Detection:

n/a

Link:

https://www.capesandbox.com/analysis/79977/

Result

Verdict:

Clean

Maliciousness:

Behaviour

Creating a file in the %temp% directory

Delayed reading of the file

Delayed writing of the file

Result

Threat name:

Unknown

Detection:

malicious

Classification:

n/a

Score:

52 / 100

Link:

https://www.joesandbox.com/analysis/513868

Signature

Machine Learning detection for sample

Multi AV Scanner detection for submitted file

Behaviour

Behavior Graph:

Download SVG

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/84e360a829386b13dbf487803bc7b8a04f68b9b743ebfa3c9eea76abe00773d4/

Threat name:

Win32.Trojan.ZLoader

Status:

Malicious

First seen:

2020-10-27 14:42:30 UTC

AV detection:

22 of 28 (78.57%)

Threat level:

5/5

Detection(s):

Malicious file

Link:

https://check.spamhaus.org/check/?searchterm=qtrwbkbjhbvrhw7uq6adxr5yubhwronxipv7upe65j3kxyahopka._file

Verdict:

malicious

Label(s):

zloader

Result

Malware family:

zloader

Score:

10/10

Tags:

family:zloader botnet:nut campaign:26/10 botnet trojan

Link:

https://tria.ge/reports/201027-78xgypjp9s/

Behaviour

Suspicious use of WriteProcessMemory

Zloader, Terdot, DELoader, ZeusSphinx

Malware Config

C2 Extraction:

https://kare.academy/wl9nfl.php
https://skal.tk/a0qqpr.php
https://casascala.isoladelba.it/1lhdcb.php
https://tamilgreets.com/0vjkrn.php
https://ahoracallao.com/kzqlgx.php
https://shbiolabs.com/gkqm9o.php
https://bmavan.com/qshecj.php
https://barsoleillevant.fr/czdhxu.php
https://innovabusiness.cv/assly0.php
https://mevededustderin.tk/wp-smarts.php

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

ZLoader

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/84e360a829386b13dbf487803bc7b8a04f68b9b743ebfa3c9eea76abe00773d4

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	crime_win32_zloader_a0 Create hunting rule
Author:	Rony (@r0ny_123)
Description:	Detects Zloader Payload

Rule name:	win_zloader_auto Create hunting rule
Author:	Felix Bilstein - yara-signator at cocacoding dot com
Description:	autogenerated rule brought to you by yara-signator