MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 9c201b6131cd721438f814bd308168b95a3bfbc7785c9ac2ee19209ae50e8232. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


ZLoader


Vendor detections: 9


Intelligence 9 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 9c201b6131cd721438f814bd308168b95a3bfbc7785c9ac2ee19209ae50e8232
SHA3-384 hash: b5a88d4537b7e66211e69724ecd8d3a9e374a63c3ecdeb8b346a3c1f5d11c9f8ff31d159959196183890dec1a5684e68
SHA1 hash: 2c9e8fa1e4f7dd5547880e0b7b56148553fdfdde
MD5 hash: 67fc6cca4761bb4913b49d3257dff8a4
humanhash: helium-arkansas-carolina-black
File name:#Zloader.tmp
Download: download sample
Signature ZLoader
Create hunting rule
File size:545'792 bytes
First seen:2021-06-08 16:26:31 UTC
Last seen:2021-06-09 07:45:58 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash 391c46e3c02104e58c6e0324dd1142f1 (1 x ZLoader)
ssdeep 12288:BS+yRfST74eG31RctHqWmqFUNQnIfEjhLtKKHTtJzEC6cQ:IRfSHs1RctH3zUNaIfEtLt/HTttECxQ
Threatray 83 similar samples on MalwareBazaar
TLSH 75C49E945E54EAF9F6B6AC3ED984DEA0F2581C01AEFDE49B634606C06D387C07D3B049
Reporter KodaES
Tags:exe ZLoader


Avatar
KodaES
#Zloader
https://twitter.com/nao_sec/status/1402277547350663170?s=20
https://app.any.run/tasks/314706e9-5815-47b2-9359-9ba49c7860bb/#

Intelligence

File Origin
# of uploads :
2
# of downloads :
298
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
microsoft_shared.tmp
Verdict:
No threats detected
Analysis date:
2021-06-08 14:53:03 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/0a020081-bcee-4485-b1e1-cbcbb2690a9f

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/165433/
Detection(s):
SecuriteInfo.com.Trojan.Win32.Save.a.9027.15825.UNOFFICIAL
Create hunting rule

Result
Verdict:
Clean
Maliciousness:

Behaviour
Sending a UDP request
Result
Verdict:
UNKNOWN
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Result
Threat name:
Unknown
Detection:
malicious
Classification:
n/a
Score:
48 / 100
Link:
https://www.joesandbox.com/analysis/799039
Signature
Multi AV Scanner detection for submitted file
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 431435 Sample: #Zloader.tmp Startdate: 08/06/2021 Architecture: WINDOWS Score: 48 28 Multi AV Scanner detection for submitted file 2->28 7 loaddll32.exe 1 2->7         started        process3 process4 9 iexplore.exe 1 75 7->9         started        11 cmd.exe 1 7->11         started        13 regsvr32.exe 7->13         started        15 17 other processes 7->15 process5 17 iexplore.exe 151 9->17         started        20 rundll32.exe 11->20         started        dnsIp6 22 tls13.taboola.map.fastly.net 151.101.1.44, 443, 49748, 49749 FASTLYUS United States 17->22 24 geolocation.onetrust.com 104.20.185.68, 443, 49736, 49737 CLOUDFLARENETUS United States 17->24 26 8 other IPs or domains 17->26
Detection:
zloader
Create hunting rule
Link:
https://mwdb.cert.pl/sample/9c201b6131cd721438f814bd308168b95a3bfbc7785c9ac2ee19209ae50e8232/
Threat name:
Win32.Trojan.Wacatac
Create hunting rule
Status:
Malicious
First seen:
2021-06-08 16:27:09 UTC
AV detection:
5 of 46 (10.87%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=tqqbwyjrzvzbiohycs6tbalixfndx66hpbojvqxodeqjvzioqiza._file
Verdict:
malicious
Label(s):
zloader
Create hunting rule
Similar samples:
12e5c221195f7d0a47b98b5d5fff26ea8fc4ad4f76f1c21f47e3a73102f18c59
ZLoader
3f1f00054377124affd8fb24f61b9a670858cc44282ffcf0341907f9dbcf1d51
ZLoader
44ede6e1b9be1c013f13d82645f7a9cff7d92b267778f19b46aa5c1f7fa3c10b
ZLoader
481af12b4e027b76b68c817c3cb806291f52042d3b5dce2e9f073408f596e206
ZLoader
8895213de00492d3755473bdc57627cdd9d90189b043f2a3dc7ae948d589eb1d
ZLoader
89e83ef4b109f38ef1f9d8dd2ab6005426e2f24c5cf106717af3eb2bdb69c78e
ZLoader
9ef6c5467fd80274e6a37e2883a5e83a894cf2148ce37bf0adb1e884acbc4c0b
ZLoader
a7f441793b5703b349ebb2509b6af1cdfdd8023d8e56f1f9a57b9d74e69bd9a9
ZLoader
b250b1ccb8194ce1ccc86b4a88bd7279f6804fac990758e95d203fdd1d97dcc2
ZLoader
cbf6848b72b118e090953347982de71cfe1510dfdc4affdb1ee4d5d62af428d6
ZLoader
+ 73 additional samples on MalwareBazaar
Result
Malware family:
zloader
Create hunting rule
Score:
  10/10
Tags:
family:zloader botnet:personal campaign:personal botnet trojan
Link:
https://tria.ge/reports/210608-d5t9wkxwf6/
Behaviour
Suspicious use of WriteProcessMemory
Zloader, Terdot, DELoader, ZeusSphinx
Malware Config
C2 Extraction:
https://iqowijsdakm.com/gate.php
https://wiewjdmkfjn.com/gate.php
https://dksaoidiakjd.com/gate.php
https://iweuiqjdakjd.com/gate.php
https://yuidskadjna.com/gate.php
https://olksmadnbdj.com/gate.php
https://odsakmdfnbs.com/gate.php
https://odsakjmdnhsaj.com/gate.php
https://odjdnhsaj.com/gate.php
https://odoishsaj.com/gate.php
Unpacked files
SH256 hash:
9c201b6131cd721438f814bd308168b95a3bfbc7785c9ac2ee19209ae50e8232
MD5 hash:
67fc6cca4761bb4913b49d3257dff8a4
SHA1 hash:
2c9e8fa1e4f7dd5547880e0b7b56148553fdfdde
Link:
https://www.unpac.me/results/9d3d0ac2-0bfc-44d5-92f2-5ffb98523127/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/9c201b6131cd721438f814bd308168b95a3bfbc7785c9ac2ee19209ae50e8232

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/165433/

Comments