🤲🏼 NEW | abuse.ch Community Hub! Earn recognition 🏅 for the malware intelligence you share, climb the leaderboards 📈, and connect with like-minded contributors who share your hunting focus 🤝. Ready to unlock your profile? Go to the Community Hub →

MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 9f654fe304bd80d1114c515362319c59bc569a54cb445aacdf47672d56815da1. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


ZLoader


Vendor detections: 11


Intelligence 11 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 9f654fe304bd80d1114c515362319c59bc569a54cb445aacdf47672d56815da1
SHA3-384 hash: 3b52aee7599cb4833db90c379d791b3905c03c0e69885e58be7564d6647bc5f5198c8a44642488d86212484877eac34a
SHA1 hash: fca002da98c91b019a3fab4639a4b6e4d0de43d7
MD5 hash: 12368655038e920cb2ada7d34fac40dd
humanhash: sad-sixteen-high-wolfram
File name:File2.exe
Download: download sample
Signature ZLoader
Create hunting rule
File size:215'040 bytes
First seen:2020-10-13 21:44:15 UTC
Last seen:2020-12-25 09:33:26 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash 92ceaac39413ae64809c890933d41cf4 (1 x ZLoader)
ssdeep 3072:6dhbHLhjn6qVxY+nxUJrvlVaCxQvCSN5ylJJiKU35W4BWXeYRq:6TbHLhjnZpK1xuCQydiKWN+E
Threatray 12 similar samples on MalwareBazaar
TLSH 1324C02135A28072C6676A3508E4CB655BBFF8719F7541CB37EC2B2E9E702E04A36717
Reporter James_inthe_box
Tags:exe ZLoader

Intelligence

File Origin
# of uploads :
3
# of downloads :
141
Origin country :
n/a
Vendor Threat Intelligence
Detection:
Zloader
Create hunting rule
Link:
https://www.capesandbox.com/analysis/70636/
Detection(s):
SecuriteInfo.com.BehavesLike.Win32.Emotet.dc.22035.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Sending a UDP request
Launching a process
Creating a file in the %AppData% subdirectories
Creating a window
Unauthorized injection to a system process
Result
Threat name:
Unknown
Detection:
malicious
Classification:
evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/490450
Signature
Allocates memory in foreign processes
Contains functionality to inject code into remote processes
Detected unpacking (changes PE section rights)
Detected unpacking (overwrites its own PE header)
Machine Learning detection for dropped file
Machine Learning detection for sample
Multi AV Scanner detection for domain / URL
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)
Writes to foreign memory regions
Behaviour
Behavior Graph:
Download SVG
Detection:
zloader
Create hunting rule
Link:
https://mwdb.cert.pl/sample/9f654fe304bd80d1114c515362319c59bc569a54cb445aacdf47672d56815da1/
Threat name:
Win32.Trojan.Azorult
Create hunting rule
Status:
Malicious
First seen:
2020-10-13 21:44:07 UTC
File Type:
PE (Exe)
Extracted files:
9
AV detection:
26 of 29 (89.66%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=t5su7yyexwancekmkfjwemm4lg6fngsuzncfvlg7i5ts2vublwqq._file
Verdict:
malicious
Label(s):
zloader
Create hunting rule
Similar samples:
00272dd639402fa76db43207d074fe52d4849e5d46008f786b944a789b09afc2
ZLoader
0c8569e4304f46352b041dcb692f85c9e195130db2013d4f2216130603478035
ZLoader
23843640cfae43671a48b17dc4fe585a8e37e3767039f82448077c5b54694a57
ZLoader
25d19c2c3cb08b7634e2bc8ec87f05765bca558e74899c9e71e576d23cd70266
ZLoader
431a34f1ab6dec2c646b408b9b5ce091882244fde39498484fc0c73390d8f7f0
ZLoader
8a07427bbf6b92d273580d2806da69c0059aa574a63dad2bd061445c985d67be
ZLoader
a2387ef5d3af113c8c902f478df1c2d7f7a7acf729873b13508c1f1915bf5000
ZLoader
b866a18458d22f3c362eb9db308ccbbe80ad1a1ef04d9f1c8ba6d3c66ccd4971
ZLoader
ca1b4e983030b69980269bb1335ba3baad6870024f564495ef99f5b98e4d07d3
ZLoader
dec5d4a8805defd810a545d6cb3e46cb7bb72a63f0d1c60cef82baf15bfad39b
ZLoader
+ 2 additional samples on MalwareBazaar
Result
Malware family:
zloader
Create hunting rule
Score:
  10/10
Tags:
trojan botnet family:zloader
Link:
https://tria.ge/reports/201013-8txyzwdftn/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Suspicious use of SetThreadContext
Suspicious use of NtCreateUserProcessOtherParentProcess
Zloader, Terdot, DELoader, ZeusSphinx
Malware Config
C2 Extraction:
https://freebreez.com/LKhwojehDgwegSDG/gateJKjdsh.php
https://makaronz.com/LKhwojehDgwegSDG/gateJKjdsh.php
https://ricklick.com/LKhwojehDgwegSDG/gateJKjdsh.php
https://litlblockblack.com/LKhwojehDgwegSDG/gateJKjdsh.php
https://vaktorianpackif.com/LKhwojehDgwegSDG/gateJKjdsh.php
https://hbamefphmqsdgkqojgwe.com/LKhwojehDgwegSDG/gateJKjdsh.php
https://hoxfqvlgoabyfspvjimc.com/LKhwojehDgwegSDG/gateJKjdsh.php
https://yrsfuaegsevyffrfsgpj.com/LKhwojehDgwegSDG/gateJKjdsh.php
Unpacked files
SH256 hash:
70bc549fa767ae46f9ab30174a1ef8cf23ad14f5af6e158f42d07567cb64f7ca
MD5 hash:
1afc21de2836e3ac5357e62985dd799e
SHA1 hash:
4615fbbcbc9712bced4736e6de21c40f772c9a1e
Detections:
win_zloader_auto
Create hunting rule
Link:
https://www.unpac.me/results/5c4bbcb3-c9e7-43a7-9adb-538868b66d84/
SH256 hash:
9f654fe304bd80d1114c515362319c59bc569a54cb445aacdf47672d56815da1
MD5 hash:
12368655038e920cb2ada7d34fac40dd
SHA1 hash:
fca002da98c91b019a3fab4639a4b6e4d0de43d7
Link:
https://www.unpac.me/results/5c4bbcb3-c9e7-43a7-9adb-538868b66d84/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Kryptik
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/9f654fe304bd80d1114c515362319c59bc569a54cb445aacdf47672d56815da1

File information

The table below shows additional information about this malware sample such as delivery method and external references.

  
Delivery method
Other
Cape
Cape
https://www.capesandbox.com/analysis/70636/

Comments