MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 bd8fb3c8abf97cdd741af7e8fd921a3b5d4a1efde9490933e405baa8f5226101. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

ZLoader

Vendor detections: 11

Intelligence 11 IOCs YARA 2 File information Comments

SHA256 hash:	bd8fb3c8abf97cdd741af7e8fd921a3b5d4a1efde9490933e405baa8f5226101
SHA3-384 hash:	12139aa9998164085fabcaa9dccb293e79a11f11c8297b58326050dee616a7b3aec25260ddb827109405ce61fa168005
SHA1 hash:	64b3489a39907d5a8adc8fabf18afeb6f573a97e
MD5 hash:	9fc59f68d528d95e13a706e6f5c8cc9d
humanhash:	robert-enemy-jupiter-fillet
File name:	9fc59f68d528d95e13a706e6f5c8cc9d.dll
Download:	download sample
Signature	ZLoader Create hunting rule
File size:	365'912 bytes
First seen:	2021-01-12 17:02:16 UTC
Last seen:	Never
File type:	dll
MIME type:	application/x-dosexec
imphash	9f377d945db467e35cbad38db9412261 (2 x ZLoader, 2 x Gozi)
ssdeep	3072:QS/x6iBO1tskRY07DCjE7dGDp1BHHIQSEw66FFTVjur5MWqcdi9toG7fWtzS3gId:QS/x8J7Dm1BHoxEw5VurWW+9toEojC
TLSH	D874CFD5EB35215BC889CBF0F9EEA844702CDB56FC54C1A4CD20F62ACDD41CEA513A6A
Reporter	abuse_ch
Tags:	dll ZLoader

Intelligence

File Origin

# of uploads :

# of downloads :

142

Origin country :

n/a

Vendor Threat Intelligence

Detection:

Zloader

Link:

https://www.capesandbox.com/analysis/111529/

Detection(s):

SecuriteInfo.com.Mal.EncPk-APV.2505.28376.UNOFFICIAL

Result

Verdict:

Malware

Maliciousness:

Behaviour

Sending a UDP request

Creating a file in the %temp% directory

Delayed reading of the file

Delayed writing of the file

Result

Verdict:

MALICIOUS

Details

Windows PE Executable

Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.

Result

Threat name:

Unknown

Detection:

suspicious

Classification:

n/a

Score:

28 / 100

Link:

https://www.joesandbox.com/analysis/579233

Signature

Creates autostart registry keys with suspicious values (likely registry only malware)

Behaviour

Behavior Graph:

Download SVG

Detection:

zloader

Link:

https://mwdb.cert.pl/sample/bd8fb3c8abf97cdd741af7e8fd921a3b5d4a1efde9490933e405baa8f5226101/

Threat name:

Win32.Downloader.Zload

Status:

Malicious

First seen:

2021-01-12 17:03:09 UTC

AV detection:

10 of 28 (35.71%)

Threat level:

3/5

Detection(s):

Malicious file

Link:

https://check.spamhaus.org/check/?searchterm=xwh3hsfl7f6n25a267up3eq2hnouuhx55feqsm7eaw5kr5jcmeaq._file

Result

Malware family:

zloader

Score:

10/10

Tags:

family:zloader botnet:googleaktualizacija campaign:googleaktualizacija2 botnet trojan

Link:

https://tria.ge/reports/210112-x5vxsf4b9x/

Behaviour

Suspicious use of WriteProcessMemory

Zloader, Terdot, DELoader, ZeusSphinx

Malware Config

C2 Extraction:

https://iqowijsdakm.com/gate.php
https://wiewjdmkfjn.com/gate.php
https://dksaoidiakjd.com/gate.php
https://iweuiqjdakjd.com/gate.php
https://yuidskadjna.com/gate.php
https://olksmadnbdj.com/gate.php
https://odsakmdfnbs.com/gate.php
https://odsakjmdnhsaj.com/gate.php
https://odjdnhsaj.com/gate.php
https://odoishsaj.com/gate.php

Unpacked files

SH256 hash:

bd8fb3c8abf97cdd741af7e8fd921a3b5d4a1efde9490933e405baa8f5226101

MD5 hash:

9fc59f68d528d95e13a706e6f5c8cc9d

SHA1 hash:

64b3489a39907d5a8adc8fabf18afeb6f573a97e

Link:

https://www.unpac.me/results/cac118e3-b148-487a-8849-40e8af4008c8/

SH256 hash:

7ed18d741fe7138acf1694dc70c48c09d89652de0c2250ee9867f79a3853d820

MD5 hash:

7c8183aeee4394a3a759b1cacbdab36e

SHA1 hash:

a36a341eb83fb88417d0500f86d757ade98b21f9

Detections:

win_zloader_auto

Link:

https://www.unpac.me/results/cac118e3-b148-487a-8849-40e8af4008c8/

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Suspicious File

Score:

0.51

Link:

https://yomi.yoroi.company/submissions/bd8fb3c8abf97cdd741af7e8fd921a3b5d4a1efde9490933e405baa8f5226101

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	win_zloader_auto Create hunting rule
Author:	Felix Bilstein - yara-signator at cocacoding dot com
Description:	autogenerated rule brought to you by yara-signator