🤲🏼 NEW | abuse.ch Community Hub! Earn recognition 🏅 for the malware intelligence you share, climb the leaderboards 📈, and connect with like-minded contributors who share your hunting focus 🤝. Ready to unlock your profile? Go to the Community Hub →

MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 cbe76b68ade1838441294ffc661c7f7329bd26c04de70e4d22c7bfb87ed3c943. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


ZLoader


Vendor detections: 5


Intelligence 5 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: cbe76b68ade1838441294ffc661c7f7329bd26c04de70e4d22c7bfb87ed3c943
SHA3-384 hash: aea7021d05f6eeb3463428e59b8f85d0a53f126486f5a1a7e14769fca1c003aee39d136c50bfad4113791d52aa358a8e
SHA1 hash: abe0287899a323ec57bacee9edbc85ae7ec0ea30
MD5 hash: 99dbb0f00c0a4a675ff967249b417903
humanhash: indigo-pasta-nine-sierra
File name:9269a94774598c3cec7c7c7654dd81a1
Download: download sample
Signature ZLoader
Create hunting rule
File size:535'896 bytes
First seen:2020-11-17 12:17:26 UTC
Last seen:Never
File type:DLL dll
MIME type:application/x-dosexec
imphash 669dace1cbc58dcb9c3d3fdd026eed29 (1 x ZLoader)
ssdeep 3072:KizUDxPs3Wo9MuFaNJXzWPfdidHzaCiZv1DwWD3aw8Vnx/VJqX8IoxKOgl9ahvk3:ZuyRLavQTjd8VzJSnyK1UhvknZ5
TLSH 1EB42194BD991260A5AD0D23374B39AB05CB3453FB77602626E73FE1F4A05B43DBA321
Reporter seifreed
Tags:ZLoader

Intelligence

File Origin
# of uploads :
1
# of downloads :
87
Origin country :
n/a
Vendor Threat Intelligence
Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
Creating a file in the %temp% directory
Delayed writing of the file
Delayed reading of the file
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/cbe76b68ade1838441294ffc661c7f7329bd26c04de70e4d22c7bfb87ed3c943/
Threat name:
Win32.Trojan.MintZamg
Create hunting rule
Status:
Malicious
First seen:
2020-11-17 12:23:35 UTC
AV detection:
24 of 29 (82.76%)
Threat level:
  5/5
Result
Malware family:
zloader
Create hunting rule
Score:
  10/10
Tags:
family:zloader botnet:googleaktualizacija campaign:googleaktualizacija1 botnet trojan
Link:
https://tria.ge/reports/201117-7ee1c6xwjs/
Behaviour
Suspicious use of WriteProcessMemory
Zloader, Terdot, DELoader, ZeusSphinx
Malware Config
C2 Extraction:
https://iqowijsdakm.ru/gate.php
https://wiewjdmkfjn.ru/gate.php
https://dksaoidiakjd.su/gate.php
https://iweuiqjdakjd.su/gate.php
https://yuidskadjna.su/gate.php
https://olksmadnbdj.su/gate.php
https://odsakmdfnbs.com/gate.php
https://odsakjmdnhsaj.com/gate.php
https://odjdnhsaj.com/gate.php
https://odoishsaj.com/gate.php
Unpacked files
SH256 hash:
cbe76b68ade1838441294ffc661c7f7329bd26c04de70e4d22c7bfb87ed3c943
MD5 hash:
99dbb0f00c0a4a675ff967249b417903
SHA1 hash:
abe0287899a323ec57bacee9edbc85ae7ec0ea30
Link:
https://www.unpac.me/results/953110a1-63fa-4c1c-bcf0-ed017fb2055a/
SH256 hash:
429add478acb38b6b4c1175ea8e567425a59e26103e3bf316c1996a17a9b8305
MD5 hash:
1142998c9e436421a52b0bd73d181bcc
SHA1 hash:
ebfa630ba602fe56301b55cbf1187796f0f0b2ce
Detections:
win_zloader_auto
Create hunting rule
Link:
https://www.unpac.me/results/953110a1-63fa-4c1c-bcf0-ed017fb2055a/
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

  
Delivery method
Other

Comments