MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 8d1cba212e338195e1edb8d4e4dde560fd9a36c0d177d6f5419e4e4e5e5c5b3d. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Intelligence File information Yara Comments

SHA256 hash: 8d1cba212e338195e1edb8d4e4dde560fd9a36c0d177d6f5419e4e4e5e5c5b3d
SHA3-384 hash: 6b0978f15ee6d40614c2ab1233a39d961f74043d92b3224f8207f764c6ab9787ca542ef9aa47b54114e4dc8edb4c4e2d
SHA1 hash: 4a007e1c530cdd23f9ea800f0530f4da6a5d7080
MD5 hash: bb7433758b61eb6483579bdae17392cf
humanhash: alaska-tennis-berlin-robin
File name:zloader 2_1.0.9.0.vir
Download: download sample
Signature ZLoader
File size:154'624 bytes
First seen:2020-07-19 19:50:07 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash d42ea863baebe90ff37d48d2f7c1c353
ssdeep 3072:/n2+JHu+q0rL8ksyiBF8BZD8asop3mC++Y/VnRscTlueB2ye5ih:f2+JHNsy6F8Ftw+OnRscTYeDe5i
TLSH 91E3395B063BC1B7E41321F41A3F23FF9E76D6003EAA4B53C7505894AF649AC261B49E
Reporter @tildedennis
Tags:ZLoader zloader 2


Twitter
@tildedennis
zloader 2 version 1.0.9.0

Intelligence


File Origin
# of uploads :
1
# of downloads :
32
Origin country :
FR FR
Mail intelligence
No data
Vendor Threat Intelligence
Result
Verdict:
Malware
Maliciousness:

Behaviour
Launching a process
Creating a file in the %AppData% subdirectories
Enabling autorun with the standard Software\Microsoft\Windows\CurrentVersion\Run registry branch
Unauthorized injection to a system process
Result
Threat name:
Unknown
Detection:
malicious
Classification:
evad
Score:
100 / 100
Behaviour
Behavior Graph:
Threat name:
Win32.Trojan.Dridex
Status:
Malicious
First seen:
2019-12-26 16:14:47 UTC
AV detection:
23 of 29 (79.31%)
Threat level
  5/5
Result
Malware family:
zloader
Score:
  10/10
Tags:
trojan botnet family:zloader persistence
Behaviour
Suspicious use of WriteProcessMemory
Suspicious use of AdjustPrivilegeToken
Suspicious use of SetThreadContext
Adds Run key to start application
Blacklisted process makes network request
Zloader, Terdot, DELoader, ZeusSphinx
Threat name:
Unknown
Score:
1.00

File information


The table below shows additional information about this malware sample such as delivery method and external references.

Comments