🤲🏼 NEW | abuse.ch Community Hub! Earn recognition 🏅 for the malware intelligence you share, climb the leaderboards 📈, and connect with like-minded contributors who share your hunting focus 🤝. Ready to unlock your profile? Go to the Community Hub →

MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 96433fbd9fa83d9a5d2490243741ee7c4e02bb2bae91ba8d5f54114fe0229c09. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


ZLoader


Vendor detections: 3


Intelligence 3 IOCs YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 96433fbd9fa83d9a5d2490243741ee7c4e02bb2bae91ba8d5f54114fe0229c09
SHA3-384 hash: d0321661446cda75bd0d5c7a3f01f85e5a119207359c57330e2e96aef2663acab5f49077b7cc0d71153f773a329e1f36
SHA1 hash: f5b94fd7db96d344dcddd8c16a6ed843a935ec04
MD5 hash: 6f51cd7daa51e281306e273fce6d69e4
humanhash: sink-cold-steak-alanine
File name:paldcnda.vbe
Download: download sample
Signature ZLoader
Create hunting rule
File size:731'791 bytes
First seen:2020-10-06 14:33:18 UTC
Last seen:Never
File type:Visual Basic Script (vbe) vbe
MIME type:text/plain
ssdeep 12288:LTf60ScA7537ZZCnNpKtqOL1KZ5jKVjWgFWIeN15W/Y+MkduOeH:X6FwnL2jQTsvs
TLSH 9BF49D614B9C8AD996584F0BD02D970EA3B31BA7C4BE74CC32663C1BEB1EC1C56178B5
Reporter JAMESWT_WT
Tags:vbe ZLoader

Intelligence

File Origin
# of uploads :
1
# of downloads :
562
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/96433fbd9fa83d9a5d2490243741ee7c4e02bb2bae91ba8d5f54114fe0229c09/
Threat name:
Script-VBS.Trojan.Ymacco
Create hunting rule
Status:
Malicious
First seen:
2020-10-06 04:38:15 UTC
File Type:
Text (VBS)
AV detection:
12 of 29 (41.38%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=szbt7pm7va6zuxjesasdoqpoprhafozlv2i3vdk7kqiu7ybctqeq._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/96433fbd9fa83d9a5d2490243741ee7c4e02bb2bae91ba8d5f54114fe0229c09

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:SUSP_Double_Base64_Encoded_Executable
Create hunting rule
Author:Florian Roth
Description:Detects an executable that has been encoded with base64 twice
Reference:https://twitter.com/TweeterCyber/status/1189073238803877889

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Comments