MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 c247aa8ff45f67b7bd2786ddd906fd1500a445364a8074b8320ca2dc179dc5be. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


ZLoader


Vendor detections: 10


Intelligence 10 IOCs YARA 2 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: c247aa8ff45f67b7bd2786ddd906fd1500a445364a8074b8320ca2dc179dc5be
SHA3-384 hash: 895cdd877546cf6f4ae61f7476e4dd46a06d37f6826c6cbc2b25c40e6e2873c67b5df28521e6d8d1585e7da8a2891d5d
SHA1 hash: 8b21a14c2617a32943a16ae531f1ac7f5cf37c99
MD5 hash: 06b4d887ac67c5216f0c99488a8adeaa
humanhash: tennessee-winner-speaker-pluto
File name:6TIO7HUX.dll
Download: download sample
Signature ZLoader
Create hunting rule
File size:325'120 bytes
First seen:2021-02-05 16:41:22 UTC
Last seen:2021-02-05 18:58:03 UTC
File type:DLL dll
MIME type:application/x-dosexec
imphash deea61f74670b0b2bf00518ab7d4d1ff (1 x ZLoader)
ssdeep 6144:UVn/51hQl4jMx+mwZ3sNEhGcXcn0ewvRSixnGyPiZNwrSVlVSQGQ1TIqguTbzcsw:UVn/51hQl4jK+mwZ3sNaGcXcn0ewvRSK
Threatray 6 similar samples on MalwareBazaar
TLSH 91649B41BA91C0B1D08E0236BC64C9FD4A7EBE61DF7485D3B7D86F4F6A701D04A39A26
Reporter ffforward
Tags:dll ZLoader

Intelligence

File Origin
# of uploads :
2
# of downloads :
135
Origin country :
n/a
Vendor Threat Intelligence
Detection:
Zloader
Create hunting rule
Link:
https://www.capesandbox.com/analysis/115775/
Detection(s):
SecuriteInfo.com.BScope.TrojanBanker.IcedID.1409.UNOFFICIAL
Create hunting rule

Result
Verdict:
Clean
Maliciousness:

Behaviour
Sending a UDP request
Launching a process
Creating a window
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Result
Threat name:
Unknown
Detection:
malicious
Classification:
evad
Score:
52 / 100
Link:
https://www.joesandbox.com/analysis/600483
Signature
Contains functionality to inject code into remote processes
Multi AV Scanner detection for submitted file
Behaviour
Behavior Graph:
Download SVG
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/c247aa8ff45f67b7bd2786ddd906fd1500a445364a8074b8320ca2dc179dc5be/
Threat name:
Win32.Trojan.Malrep
Create hunting rule
Status:
Malicious
First seen:
2021-02-05 16:42:08 UTC
AV detection:
21 of 29 (72.41%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=yjd2vd7ul5t3ppjhq3o5sbx5cuakirjwjkahjobsbsrnyf45yw7a._file
Verdict:
malicious
Label(s):
zloader
Create hunting rule
Similar samples:
35466f0c22f220890b932e59f9a21032712e8260343d13ad4c0d9560db3b638f
ZLoader
4b0c5b4530a9218d6030a7040a10ea5be84ffa3696601732ee7212691521474f
ZLoader
5c0f9c9babc640a2578b1d3e8cacb60df32a0437ef3f9383d00ed88a7cef3a62
ZLoader
78c4bc3ae3153ba126c58e5cf86f254468c8ff422971ea3923502bfa3de8ad0b
ZLoader
c5a07a557082018c4b3526b12e681182d7e489ce22e90c2b4f68feae5f93d4d0
ZLoader
d56060acb8115119810ae3aca151e94cbe5e2459dd405c8f010ced5a25c8548a
ZLoader
Result
Malware family:
zloader
Create hunting rule
Score:
  10/10
Tags:
family:zloader botnet:nut campaign:04/02 botnet trojan
Link:
https://tria.ge/reports/210205-q9rvehfpde/
Behaviour
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Suspicious use of SetThreadContext
Blocklisted process makes network request
Zloader, Terdot, DELoader, ZeusSphinx
Malware Config
C2 Extraction:
https://vidhyashram.edu.in/post.php
https://carmeta-ampuh.com/post.php
https://bestarticleblog.com/post.php
https://alahsateam.com/post.php
https://pyggroup.com.pe/post.php
https://perlisisacsiograv.tk/post.php
Unpacked files
SH256 hash:
32046b6a13d9d7b4b3ea781996ee4792efd27c550a049c5672762041ce055d63
MD5 hash:
fab3ab4d6b7cd7b1945f6176d065c402
SHA1 hash:
fdd10968ad951f866e1814ee4a20fc2c542a7347
Detections:
win_zloader_auto
Create hunting rule
Link:
https://www.unpac.me/results/2f9e6879-0582-4d8d-8f81-6c5c78429d1b/
SH256 hash:
c247aa8ff45f67b7bd2786ddd906fd1500a445364a8074b8320ca2dc179dc5be
MD5 hash:
06b4d887ac67c5216f0c99488a8adeaa
SHA1 hash:
8b21a14c2617a32943a16ae531f1ac7f5cf37c99
Link:
https://www.unpac.me/results/2f9e6879-0582-4d8d-8f81-6c5c78429d1b/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/c247aa8ff45f67b7bd2786ddd906fd1500a445364a8074b8320ca2dc179dc5be

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:win_zloader_auto
Create hunting rule
Author:Felix Bilstein - yara-signator at cocacoding dot com
Description:autogenerated rule brought to you by yara-signator
Rule name:Zloader
Create hunting rule
Author:kevoreilly
Description:Zloader Payload

File information

The table below shows additional information about this malware sample such as delivery method and external references.

ZLoader

Excel file xls b81d1407ef833190714ccb794e46bfccf1c0ad77ae36f32bda09e34f23f0a4fc

ZLoader

DLL dll c247aa8ff45f67b7bd2786ddd906fd1500a445364a8074b8320ca2dc179dc5be

(this sample)

  
Link
https://tria.ge/210205-zflzebh28x
  
Dropped by
SHA256 b81d1407ef833190714ccb794e46bfccf1c0ad77ae36f32bda09e34f23f0a4fc
  
Delivery method
Distributed via web download
Cape
Cape
https://www.capesandbox.com/analysis/115775/

Comments