🤲🏼 NEW | abuse.ch Community Hub! Earn recognition 🏅 for the malware intelligence you share, climb the leaderboards 📈, and connect with like-minded contributors who share your hunting focus 🤝. Ready to unlock your profile? Go to the Community Hub →

MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 b513c6fc32ea4666e3be5c62d50336db003f75de5344450c8e4a2d88b8911c06. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


ZLoader


Vendor detections: 7


Intelligence 7 IOCs YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: b513c6fc32ea4666e3be5c62d50336db003f75de5344450c8e4a2d88b8911c06
SHA3-384 hash: e15dee368c3ee5b58af04b5751a97749941c0e7ae9970ec4a1ebaa72c1b6dda770312b715f8a3e15f4bd0dedb44542db
SHA1 hash: 092a7a2f5509b92adacacb3b9215e2e61ba633fc
MD5 hash: a14d7a30ec304ce96f88347b25cbb668
humanhash: indigo-hamper-skylark-gee
File name:2020-11-27-ZLoader-DLL-example-02.bin
Download: download sample
Signature ZLoader
Create hunting rule
File size:291'840 bytes
First seen:2020-11-27 19:59:12 UTC
Last seen:2020-11-27 21:46:11 UTC
File type:DLL dll
MIME type:application/x-dosexec
imphash 34952ab66bc825973ca5b18df92f2694 (1 x ZLoader)
ssdeep 6144:qtS7L4PHgZYir7d0nyjSDamb205aZDxn6wLW:oMYMrqnoLt9xn6k
TLSH 0054AE17B6D0C072E53605304479C2B6863EBD209B609EDB73D02E3F6E662E15935FAB
Reporter malware_traffic
Tags:dll SILENTNIGHT Silent_Night ZLoader

Intelligence

File Origin
# of uploads :
2
# of downloads :
189
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/105848/
Result
Verdict:
Clean
Maliciousness:

Behaviour
Sending a UDP request
Creating a file in the %temp% directory
Deleting a recently created file
Replacing files
Delayed writing of the file
Delayed reading of the file
Result
Threat name:
Unknown
Detection:
malicious
Classification:
evad
Score:
60 / 100
Link:
https://www.joesandbox.com/analysis/549656
Signature
Allocates memory in foreign processes
Contains functionality to inject code into remote processes
Multi AV Scanner detection for submitted file
Writes to foreign memory regions
Behaviour
Behavior Graph:
Download SVG
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/b513c6fc32ea4666e3be5c62d50336db003f75de5344450c8e4a2d88b8911c06/
Threat name:
Win32.Trojan.ZLoader
Create hunting rule
Status:
Malicious
First seen:
2020-11-27 20:00:07 UTC
AV detection:
24 of 29 (82.76%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=wuj4n7bs5jdgny56lrrnkazw3mad65o6kncekdeojiwyroerdqda._file
Result
Malware family:
zloader
Create hunting rule
Score:
  10/10
Tags:
family:zloader botnet:vek campaign:27/11 botnet trojan
Link:
https://tria.ge/reports/201127-rxzlgz38nx/
Behaviour
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Suspicious use of SetThreadContext
Blacklisted process makes network request
Zloader, Terdot, DELoader, ZeusSphinx
Malware Config
C2 Extraction:
https://hac3r.com/wp-punch.php
https://womtools.com/wp-punch.php
https://valitec.co/wp-punch.php
https://empresascreciendobien.com/server.php
https://smartat.co/error.php
https://teamearenttopdiaty.ga/wp-smarts.php
Unpacked files
SH256 hash:
b4378a76709a0d83309c32fbf93138e55cc05aea6ab28244fbdc5d443964d25f
MD5 hash:
549216e7ac87efe7771eed42d611dcd9
SHA1 hash:
1d5adaf88f11772d1e03dc17322074287b741b80
Detections:
win_zloader_auto
Create hunting rule
Link:
https://www.unpac.me/results/d9ca9f57-ccb8-491a-896d-e6b0d75fe4c6/
SH256 hash:
b513c6fc32ea4666e3be5c62d50336db003f75de5344450c8e4a2d88b8911c06
MD5 hash:
a14d7a30ec304ce96f88347b25cbb668
SHA1 hash:
092a7a2f5509b92adacacb3b9215e2e61ba633fc
Link:
https://www.unpac.me/results/d9ca9f57-ccb8-491a-896d-e6b0d75fe4c6/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Emotet
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/b513c6fc32ea4666e3be5c62d50336db003f75de5344450c8e4a2d88b8911c06

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:win_zloader_auto
Create hunting rule
Author:Felix Bilstein - yara-signator at cocacoding dot com
Description:autogenerated rule brought to you by yara-signator

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/105848/

Comments