🤲🏼 NEW | abuse.ch Community Hub! Earn recognition 🏅 for the malware intelligence you share, climb the leaderboards 📈, and connect with like-minded contributors who share your hunting focus 🤝. Ready to unlock your profile? Go to the Community Hub →

MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 c75f4e1fd464e21826c37e5abf7fed93b48c721625f700f49aa71cbce377ee8a. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


ZLoader


Vendor detections: 9


Intelligence 9 IOCs YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: c75f4e1fd464e21826c37e5abf7fed93b48c721625f700f49aa71cbce377ee8a
SHA3-384 hash: edb20cf8faeb9a4e7840e84d148a053f46311118cc0592b49e5dbb0f57cd710c57db5a09f48aa4974073fe9ef44de35e
SHA1 hash: 38475dc6871d88b3c9070f4e55f8c44a07b7dca3
MD5 hash: 56079ea11cb3fce2a34fdf0a81deecc5
humanhash: march-magazine-lion-july
File name:mic.dll
Download: download sample
Signature ZLoader
Create hunting rule
File size:418'816 bytes
First seen:2021-08-24 08:53:50 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash f9be3cad31c3932761094c0c4d7fbc81 (1 x ZLoader)
ssdeep 12288:jS5WNqciJOAzgUOksgh/Zuss/p5V0noFJwhNUy:jS5WNqM1UOqFZusIpYe
Threatray 114 similar samples on MalwareBazaar
TLSH T11F94BF91D7C6D678F49B013FF88B67E9102FAA824837DE679B6C19EBD7341C0912B160
dhash icon bb3bf39a9ed9e6b2 (2 x GuLoader, 1 x ZLoader)
Reporter nao_sec
Tags:exe Malsmoke ZLoader

Intelligence

File Origin
# of uploads :
1
# of downloads :
202
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/181797/
Detection(s):
SecuriteInfo.com.W32.AIDetect.malware1.32287.19958.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a file
Creating a file in the %temp% directory
Delayed reading of the file
Delayed writing of the file
Sending a UDP request
Verdict:
Suspicious
Link:
https://analyze.intezer.com/analyses/8f40edc0-ef34-4faa-962f-0d47b72eff64
Result
Threat name:
ZLoader
Create hunting rule
Detection:
malicious
Classification:
troj
Score:
60 / 100
Link:
https://www.joesandbox.com/analysis/838095
Signature
C2 URLs / IPs found in malware configuration
Found malware configuration
Yara detected ZLoader
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 470525 Sample: mic.dll Startdate: 24/08/2021 Architecture: WINDOWS Score: 60 23 dksaoidiakjd.com/gate.php unknown unknown 2->23 25 iqowijsdakm.com/gate.php unknown unknown 2->25 27 8 other IPs or domains 2->27 35 Found malware configuration 2->35 37 Yara detected ZLoader 2->37 39 C2 URLs / IPs found in malware configuration 2->39 8 loaddll32.exe 1 2->8         started        signatures3 process4 process5 10 iexplore.exe 1 73 8->10         started        12 cmd.exe 1 8->12         started        14 regsvr32.exe 1 8->14         started        16 4 other processes 8->16 process6 18 iexplore.exe 105 10->18         started        21 rundll32.exe 12->21         started        dnsIp7 29 dart.l.doubleclick.net 142.250.74.198, 443, 49727, 49728 GOOGLEUS United States 18->29 31 geolocation.onetrust.com 104.20.184.68, 443, 49721, 49722 CLOUDFLARENETUS United States 18->31 33 9 other IPs or domains 18->33
Detection:
zloader
Create hunting rule
Link:
https://mwdb.cert.pl/sample/c75f4e1fd464e21826c37e5abf7fed93b48c721625f700f49aa71cbce377ee8a/
Threat name:
Win32.Downloader.Zload
Create hunting rule
Status:
Malicious
First seen:
2021-08-24 08:54:09 UTC
AV detection:
11 of 46 (23.91%)
Threat level:
  3/5
Verdict:
malicious
Label(s):
zloader
Create hunting rule
Similar samples:
0f527546d025e3705bdbba6eb98226373a8b8368bd1d2915a5f195541566d11e
ZLoader
12e5c221195f7d0a47b98b5d5fff26ea8fc4ad4f76f1c21f47e3a73102f18c59
ZLoader
197473ef9099e43c74fc5dd19776cb4e001ccd39102c38c3bfa3f81db9fd92bb
ZLoader
26b22c0b1b4aab76f6a483ae3aec9f4eface7c7f5aeb546554afdf4ab0d54a6f
ZLoader
7ba99f8f77a2e660f1837cad9d169ccf892154da5b2651e4e6e66efddd61944c
ZLoader
9ef6c5467fd80274e6a37e2883a5e83a894cf2148ce37bf0adb1e884acbc4c0b
ZLoader
b250b1ccb8194ce1ccc86b4a88bd7279f6804fac990758e95d203fdd1d97dcc2
ZLoader
cdaca5b6aabd92a7b782c2d7b250cbc1b2ed4c5a78091271f788d58dedcd94f6
ZLoader
+ 104 additional samples on MalwareBazaar
Result
Malware family:
zloader
Create hunting rule
Score:
  10/10
Tags:
family:zloader botnet:hvnc campaign:hvnc botnet trojan
Link:
https://tria.ge/reports/210824-4taqdht2xs/
Behaviour
Suspicious use of WriteProcessMemory
Zloader, Terdot, DELoader, ZeusSphinx
Malware Config
C2 Extraction:
https://iqowijsdakm.com/gate.php
https://wiewjdmkfjn.com/gate.php
https://dksaoidiakjd.com/gate.php
https://iweuiqjdakjd.com/gate.php
https://yuidskadjna.com/gate.php
https://olksmadnbdj.com/gate.php
https://odsakmdfnbs.com/gate.php
https://odsakjmdnhsaj.com/gate.php
https://odjdnhsaj.com/gate.php
https://odoishsaj.com/gate.php
Unpacked files
SH256 hash:
31c515d157c2ba68e446556a7cff1ad44c0e2d953774442265f3dcd608ade644
MD5 hash:
f566ae0e552f27c2d8959baaf25f5234
SHA1 hash:
cc4f9f28ab5ef8f7cc056c864123c1f30e804884
Detections:
win_zloader_auto
Create hunting rule
Link:
https://www.unpac.me/results/85f01b2e-a15d-49b2-a94f-016bc8144ec1/
SH256 hash:
c75f4e1fd464e21826c37e5abf7fed93b48c721625f700f49aa71cbce377ee8a
MD5 hash:
56079ea11cb3fce2a34fdf0a81deecc5
SHA1 hash:
38475dc6871d88b3c9070f4e55f8c44a07b7dca3
Link:
https://www.unpac.me/results/85f01b2e-a15d-49b2-a94f-016bc8144ec1/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/c75f4e1fd464e21826c37e5abf7fed93b48c721625f700f49aa71cbce377ee8a

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:INDICATOR_SUSPICIOUS_Stomped_PECompilation_Timestamp_InTheFuture
Create hunting rule
Author:ditekSHen
Description:Detect executables with stomped PE compilation timestamp that is greater than local current time

File information

The table below shows additional information about this malware sample such as delivery method and external references.

86a83d400c4f6bf465bd385084a602ac548f8ea5e291a6273455492d22bebca6

ZLoader

Executable exe c75f4e1fd464e21826c37e5abf7fed93b48c721625f700f49aa71cbce377ee8a

(this sample)

  
Dropped by
SHA256 86a83d400c4f6bf465bd385084a602ac548f8ea5e291a6273455492d22bebca6
  
Delivery method
Distributed via web download
Cape
Cape
https://www.capesandbox.com/analysis/181797/

Comments