MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 b4c029f9bb6d85ace85302d25caa7ec1da9d641872ea8f62b333a667c0d7b864. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

ZLoader

Vendor detections: 12

Intelligence 12 IOCs YARA 3 File information Comments

SHA256 hash:	b4c029f9bb6d85ace85302d25caa7ec1da9d641872ea8f62b333a667c0d7b864
SHA3-384 hash:	4b9120ecf3877b2b3920cbd7b326737dccb4780a3e55b39323a0109e4d81ea55e096bff9108163d83739d67e2273bfbe
SHA1 hash:	57563b2ba10105f0183bcff42800a1b061b560a6
MD5 hash:	d057014fe0e29b2604bd852595441a22
humanhash:	hawaii-carpet-foxtrot-mike
File name:	d057014fe0e29b2604bd852595441a22.dll
Download:	download sample
Signature	ZLoader Create hunting rule
File size:	682'496 bytes
First seen:	2021-04-15 17:09:23 UTC
Last seen:	2021-04-15 18:04:45 UTC
File type:	dll
MIME type:	application/x-dosexec
imphash	1871ee680e7135cabc1e519d428eefe0 (6 x ZLoader)
ssdeep	12288:m9D8Diks/1k4R17DVu+PQYgzCNouGhKvuZk6SUxEMPEQIRAkwOBYSk8x3JVBKKZM:mG+kY9IYNouGLTxEnVdB7ku5VZrY
Threatray	20 similar samples on MalwareBazaar
TLSH	1AE4AD247580C072C5A224358E65E5F9496DBC209F2156CB73DC3F7F6B306E1AA32A7B
Reporter	abuse_ch
Tags:	dll nut ZLoader

Intelligence

File Origin

# of uploads :

# of downloads :

141

Origin country :

n/a

Vendor Threat Intelligence

Detection:

Zloader

Link:

https://www.capesandbox.com/analysis/135341/

Detection(s):

SecuriteInfo.com.Trojan.PWS.Panda.13733.29432.10690.UNOFFICIAL

Result

Verdict:

Malware

Maliciousness:

Behaviour

Sending a UDP request

Result

Verdict:

MALICIOUS

Details

Windows PE Executable

Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.

Result

Threat name:

ZLoader

Detection:

malicious

Classification:

troj

Score:

68 / 100

Link:

https://www.joesandbox.com/analysis/678068

Signature

C2 URLs / IPs found in malware configuration

Found malware configuration

Multi AV Scanner detection for submitted file

Yara detected ZLoader

Behaviour

Behavior Graph:

Download SVG

Detection:

zloader

Link:

https://mwdb.cert.pl/sample/b4c029f9bb6d85ace85302d25caa7ec1da9d641872ea8f62b333a667c0d7b864/

Threat name:

Win32.Trojan.ZLoader

Status:

Malicious

First seen:

2021-04-15 17:10:14 UTC

AV detection:

18 of 29 (62.07%)

Threat level:

5/5

Detection(s):

Malicious file

Link:

https://check.spamhaus.org/check/?searchterm=wtact6n3nwc2z2ctaljfzkt6yhnj2zayolvi6yvtgotgpqgxxbsa._file

Verdict:

malicious

Label(s):

zloader

gozi

Result

Malware family:

zloader

Score:

10/10

Tags:

family:zloader botnet:nut campaign:13/04 botnet trojan

Link:

https://tria.ge/reports/210415-p16phf7ckn/

Behaviour

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

Suspicious use of SetThreadContext

Blocklisted process makes network request

Zloader, Terdot, DELoader, ZeusSphinx

Malware Config

C2 Extraction:

https://jiaayanu.com/post.php
https://investinszeklerland.eu/post.php
https://iqs-sac.com/post.php
https://jciems.in/post.php
https://jinnahofficersschool.com/post.php
https://kancagh.com/post.php

Unpacked files

SH256 hash:

be3a15b13efad37446ff23496fd378461a8059bc29d2218c3f7da320a311d95e

MD5 hash:

6c5f28a995614af01138f7c9dc893ca6

SHA1 hash:

8dd1e38766bdab34ddcfc650077365f43ddaf2b6

Detections:

win_zloader_auto

Link:

https://www.unpac.me/results/b0ac975f-a61d-4367-8ec2-95cd7f558a72/

SH256 hash:

b4c029f9bb6d85ace85302d25caa7ec1da9d641872ea8f62b333a667c0d7b864

MD5 hash:

d057014fe0e29b2604bd852595441a22

SHA1 hash:

57563b2ba10105f0183bcff42800a1b061b560a6

Link:

https://www.unpac.me/results/b0ac975f-a61d-4367-8ec2-95cd7f558a72/

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

ZLoader

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/b4c029f9bb6d85ace85302d25caa7ec1da9d641872ea8f62b333a667c0d7b864

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	crime_win32_zloader_a0 Create hunting rule
Author:	Rony (@r0ny_123)
Description:	Detects Zloader Payload

Rule name:	win_zloader_auto Create hunting rule
Author:	Felix Bilstein - yara-signator at cocacoding dot com
Description:	autogenerated rule brought to you by yara-signator