MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 a8e65df2958dddac02f2d45995ec036f94299eb9e1a4a51fbfcc717095690ce7. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Intelligence File information Yara Comments

SHA256 hash: a8e65df2958dddac02f2d45995ec036f94299eb9e1a4a51fbfcc717095690ce7
SHA3-384 hash: 96c014ae4cc7a9b1a1317e5cb10bc076cab89a030f148dc3d06c00924377493cedf6c9e63e42c41c5ece2769e4434d9e
SHA1 hash: 4f61764049697ee68cbbf126f60f7643675289a3
MD5 hash: 6914f2cc19e40bd3343bbfc7c4994ac0
humanhash: mexico-item-ink-ink
File name:zloader 2_1.0.16.0.vir
Download: download sample
Signature ZLoader
File size:900'096 bytes
First seen:2020-07-19 19:43:09 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash 0cee685b8bcd14b805b4c869574e300a
ssdeep 24576:KMs7ad/n76VOYLBRMAJaZbTskfewcyGyMuxVo/Gfxh8:OhaJAcewcyZMIsGY
TLSH 64159E627B91F476C17E31F15986E37469AA9C304A3606B76BC02F3D2E344D15F3A22E
Reporter @tildedennis
Tags:ZLoader zloader 2


Twitter
@tildedennis
zloader 2 version 1.0.16.0

Intelligence


File Origin
# of uploads :
1
# of downloads :
21
Origin country :
FR FR
Mail intelligence
No data
Vendor Threat Intelligence
Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
Unauthorized injection to a recently created process
Connection attempt to an infection source
Result
Threat name:
Unknown
Detection:
malicious
Classification:
evad
Score:
100 / 100
Behaviour
Behavior Graph:
Threat name:
Win32.Trojan.Kryptik
Status:
Malicious
First seen:
2020-02-08 21:09:02 UTC
AV detection:
22 of 31 (70.97%)
Threat level
  2/5
Result
Malware family:
zloader
Score:
  10/10
Tags:
persistence trojan botnet family:zloader
Behaviour
Suspicious use of WriteProcessMemory
Suspicious use of SetWindowsHookEx
Suspicious use of FindShellTrayWindow
Suspicious use of SendNotifyMessage
Suspicious use of AdjustPrivilegeToken
Drops file in Windows directory
Suspicious use of SetThreadContext
Adds Run key to start application
Zloader, Terdot, DELoader, ZeusSphinx
Threat name:
Unknown
Score:
1.00

File information


The table below shows additional information about this malware sample such as delivery method and external references.

Comments