MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 959a3cd5e58c2bbbb4a5179e658f6193fd6cf8d5d5384b4e6dca12fa7cbc2c74. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

ZLoader

Vendor detections: 6

Intelligence 6 IOCs YARA File information Comments

SHA256 hash:	959a3cd5e58c2bbbb4a5179e658f6193fd6cf8d5d5384b4e6dca12fa7cbc2c74
SHA3-384 hash:	207921aee0eb8f94b1f59fb10234994c9fcc7587176daa68b73233b0a96f5290baf165e00055ff4b63dfc2904c162340
SHA1 hash:	40c8a1193954077628c5f89ee5ce9687d9f6f6de
MD5 hash:	0c5dadf565b1b19b47cbe98266f91152
humanhash:	carbon-magnesium-glucose-sweet
File name:	BKiPsIo.dll
Download:	download sample
Signature	ZLoader Create hunting rule
File size:	400'728 bytes
First seen:	2020-10-22 17:48:14 UTC
Last seen:	Never
File type:	dll
MIME type:	application/x-dosexec
imphash	ee6a56090f6a1813e908f3cd4291ea6f (2 x ZLoader)
ssdeep	3072:C05l6jCzk0HdKCKshhMy9eH4EiuWFbcaoOOK9LV+EcNsBQ9qRUVbomnN/:DnCE98sDXeHfijLo9qLV+yYqGjnN/
Threatray	46 similar samples on MalwareBazaar
TLSH	0E844F6759C3DF04D22E40FBC5FCAAB8133192380E9D4F29E75E48B5FA474992A8436D
Reporter	ffforward
Tags:	dll NOPVNXSIGTCRPCCRUA signed sovietzloader ZLoader

Intelligence

File Origin

# of uploads :

# of downloads :

Origin country :

n/a

Vendor Threat Intelligence

Detection:

Zloader

Link:

https://www.capesandbox.com/analysis/74748/

Result

Verdict:

Clean

Maliciousness:

Behaviour

Creating a file in the %temp% directory

Delayed writing of the file

Delayed reading of the file

Creating a window

Result

Threat name:

Unknown

Detection:

malicious

Classification:

n/a

Score:

48 / 100

Link:

https://www.joesandbox.com/analysis/507505

Signature

Behaviour

Behavior Graph:

Download SVG

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/959a3cd5e58c2bbbb4a5179e658f6193fd6cf8d5d5384b4e6dca12fa7cbc2c74/

Gathering data

Verdict:

malicious

Label(s):

zloader

Result

Malware family:

zloader

Score:

10/10

Tags:

trojan botnet family:zloader

Link:

https://tria.ge/reports/201022-zmeazdhpej/

Behaviour

Suspicious use of WriteProcessMemory

Zloader, Terdot, DELoader, ZeusSphinx

Malware Config

C2 Extraction:

https://kochamkkkras.ru/gate.php
https://uookqihwdid.ru/gate.php
https://iqowijsdakm.ru/gate.php
https://wiewjdmkfjn.ru/gate.php
https://dksaoidiakjd.su/gate.php
https://iweuiqjdakjd.su/gate.php
https://yuidskadjna.su/gate.php
https://olksmadnbdj.su/gate.php
https://odsakmdfnbs.su/gate.php
https://odsakjmdnhsaj.su/gate.php