MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 8eea435b67f4fe16b31c412a0648da64b919fd7eff69e33f22730ff5445e6fe3. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

ZLoader

Vendor detections: 11

Intelligence 11 IOCs YARA 2 File information Comments

SHA256 hash:	8eea435b67f4fe16b31c412a0648da64b919fd7eff69e33f22730ff5445e6fe3
SHA3-384 hash:	1bb520f06d3651ebad4b5737c316e98eead073742b8c2a96ccf6a3c5383ecfd4febe327f7115eede17f3d9a6b4367abf
SHA1 hash:	9ea1f0d5f56155d71a6e39208ea2b8bb67dbcf6d
MD5 hash:	993ac46f574f979e7c4353a710dad8a9
humanhash:	april-don-jersey-eleven
File name:	8eea435b67f4fe16b31c412a0648da64b919fd7eff69e33f22730ff5445e6fe3
Download:	download sample
Signature	ZLoader Create hunting rule
File size:	313'688 bytes
First seen:	2021-06-15 06:20:46 UTC
Last seen:	Never
File type:	dll
MIME type:	application/x-dosexec
imphash	302dc27ee8fb51d51fd455c5c954a121 (3 x ZLoader, 1 x Gozi)
ssdeep	3072:IW3jihpPN6334j29ujis6fyMhzEeSOTDAUnDAVnNrRV+BwrLcqfQD4YGqUS5LW2:H3j8pPN6n4j7Ws61E+ABnF/cl0qUuW2
Threatray	89 similar samples on MalwareBazaar
TLSH	A464F2015B1FD099D37E29B8C8F6C3C584D9CE0A29404C5CB3983BF5E67A5C8BAB651E
Reporter	JAMESWT_WT
Tags:	dll iqowijsdakm.com signed ZLoader

Code Signing Certificate

Organisation:	XFYFPUHYTZABTVZNTR
Issuer:	XFYFPUHYTZABTVZNTR
Algorithm:	sha1WithRSA
Valid from:	2021-01-10T23:21:35Z
Valid to:	2039-12-31T23:59:59Z
Serial number:	5d3ede33956cf3b547584ef32177b187
Intelligence:	3 malware samples on MalwareBazaar are signed with this code signing certificate
Thumbprint Algorithm:	SHA256
Thumbprint:	22031a72e03d309f0c1e229440904d068d6d8f87d2cde4dc11ec76de301b9da3
Source:	This information was brought to you by ReversingLabs A1000 Malware Analysis Platform

Intelligence

File Origin

# of uploads :

# of downloads :

183

Origin country :

n/a

Vendor Threat Intelligence

Detection:

Zloader

Link:

https://www.capesandbox.com/analysis/166371/

Detection(s):

Win.Packed.Qshell-9820629-0

Win.Downloader.Zload-9820630-0

Result

Verdict:

Malware

Maliciousness:

Behaviour

Creating a file in the %temp% directory

Delayed reading of the file

Delayed writing of the file

Sending a UDP request

Malware family:

Zloader

Verdict:

Malicious

Link:

https://analyze.intezer.com/analyses/c435cf3e-1fcf-4464-85ec-58b83b59cae5

Result

Threat name:

Unknown

Detection:

malicious

Classification:

n/a

Score:

60 / 100

Link:

https://www.joesandbox.com/analysis/802164

Signature

Antivirus / Scanner detection for submitted sample

Machine Learning detection for sample

Multi AV Scanner detection for submitted file

Behaviour

Behavior Graph:

Download SVG

Detection:

zloader

Link:

https://mwdb.cert.pl/sample/8eea435b67f4fe16b31c412a0648da64b919fd7eff69e33f22730ff5445e6fe3/

Threat name:

Win32.Trojan.ZLoader

Status:

Malicious

First seen:

2021-01-11 18:56:45 UTC

File Type:

PE (Dll)

Extracted files:

AV detection:

24 of 29 (82.76%)

Threat level:

5/5

Detection(s):

Malicious file

Link:

https://check.spamhaus.org/check/?searchterm=r3vegw3h6t7bnmy4ievamsg2ms4rt7l675u6gpzcomh7krc6n7rq._file

Verdict:

malicious

Label(s):

zloader

Result

Malware family:

zloader

Score:

10/10

Tags:

family:zloader botnet:googleaktualizacija campaign:googleaktualizacija2 botnet trojan

Link:

https://tria.ge/reports/210615-6zp4tr5xdx/

Behaviour

Suspicious use of WriteProcessMemory

Zloader, Terdot, DELoader, ZeusSphinx

Malware Config

C2 Extraction:

https://iqowijsdakm.com/gate.php
https://wiewjdmkfjn.com/gate.php
https://dksaoidiakjd.com/gate.php
https://iweuiqjdakjd.com/gate.php
https://yuidskadjna.com/gate.php
https://olksmadnbdj.com/gate.php
https://odsakmdfnbs.com/gate.php
https://odsakjmdnhsaj.com/gate.php
https://odjdnhsaj.com/gate.php
https://odoishsaj.com/gate.php

Unpacked files

SH256 hash:

4f2534f80d6ee2b5ab70618af27af3157b86060e67b2d0bc97add7a70f92b60f

MD5 hash:

b643d64cb216aab041bd4e3af69598ae

SHA1 hash:

27ee7f09e9a1627843415071bb8936e958010840

Detections:

win_zloader_auto

Link:

https://www.unpac.me/results/43684a38-8d4d-4ea1-803a-833b8721b220/

SH256 hash:

8eea435b67f4fe16b31c412a0648da64b919fd7eff69e33f22730ff5445e6fe3

MD5 hash:

993ac46f574f979e7c4353a710dad8a9

SHA1 hash:

9ea1f0d5f56155d71a6e39208ea2b8bb67dbcf6d

Link:

https://www.unpac.me/results/43684a38-8d4d-4ea1-803a-833b8721b220/

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Legit

Score:

0.09

Link:

https://yomi.yoroi.company/submissions/8eea435b67f4fe16b31c412a0648da64b919fd7eff69e33f22730ff5445e6fe3

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	win_zloader_auto Create hunting rule
Author:	Felix Bilstein - yara-signator at cocacoding dot com
Description:	autogenerated rule brought to you by yara-signator