MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 cdaca5b6aabd92a7b782c2d7b250cbc1b2ed4c5a78091271f788d58dedcd94f6. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


ZLoader


Vendor detections: 5


Intelligence 5 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: cdaca5b6aabd92a7b782c2d7b250cbc1b2ed4c5a78091271f788d58dedcd94f6
SHA3-384 hash: 05eb3c328dea6d374133f85a0078c72c31521f42732db75ef6150307bc7eb9ebcfca6a73c402dbb95e5f66d102f89503
SHA1 hash: 1a9c9258f0345f5edddd933a7bd15ec42be51f8e
MD5 hash: a9dd9b9eff47af724436e2abdcd5ce6c
humanhash: friend-six-hawaii-ink
File name:a9dd9b9eff47af724436e2abdcd5ce6c.exe
Download: download sample
Signature ZLoader
Create hunting rule
File size:497'328 bytes
First seen:2021-08-12 13:48:10 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash 271c576c8fc6bd157aead4bf8676c94a (1 x ZLoader)
ssdeep 12288:oSOtDj2zB3iGZDhWVw/D0//EwImW70sct029xey5ZgA:qD6F3RYg0T/cy5Zv
Threatray 99 similar samples on MalwareBazaar
TLSH T1FDB4B051CDCD1A30F2AE123E848B53F69A3E6D51AB18B577D64CBEBDD1F4180E812B60
dhash icon 580064ecfaded0c0 (1 x ZLoader)
Reporter abuse_ch
Tags:exe ZLoader

Intelligence

File Origin
# of uploads :
1
# of downloads :
240
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
a9dd9b9eff47af724436e2abdcd5ce6c.exe
Verdict:
No threats detected
Analysis date:
2021-08-12 13:53:32 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/74c5fd6c-ebef-47e8-be86-4515e37a5d91

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/178739/
Detection(s):
SecuriteInfo.com.W32.AIDetect.malware1.29229.7975.UNOFFICIAL
Create hunting rule

Result
Verdict:
Clean
Maliciousness:

Behaviour
Sending a UDP request
Result
Verdict:
UNKNOWN
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Verdict:
Suspicious
Link:
https://analyze.intezer.com/analyses/68aa26e3-58c2-434e-935e-3afbd6f4d0a9
Result
Threat name:
Unknown
Detection:
malicious
Classification:
n/a
Score:
56 / 100
Link:
https://www.joesandbox.com/analysis/831877
Signature
Machine Learning detection for sample
Multi AV Scanner detection for submitted file
PE file has a writeable .text section
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 464319 Sample: 3bJrnQ0otj.exe Startdate: 12/08/2021 Architecture: WINDOWS Score: 56 28 Multi AV Scanner detection for submitted file 2->28 30 Machine Learning detection for sample 2->30 32 PE file has a writeable .text section 2->32 7 loaddll32.exe 1 2->7         started        process3 process4 9 iexplore.exe 2 83 7->9         started        11 cmd.exe 1 7->11         started        13 regsvr32.exe 7->13         started        15 4 other processes 7->15 process5 17 iexplore.exe 7 101 9->17         started        20 rundll32.exe 11->20         started        dnsIp6 22 dart.l.doubleclick.net 216.58.215.230, 443, 49735, 49736 GOOGLEUS United States 17->22 24 geolocation.onetrust.com 104.20.185.68, 443, 49729, 49730 CLOUDFLARENETUS United States 17->24 26 8 other IPs or domains 17->26
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/cdaca5b6aabd92a7b782c2d7b250cbc1b2ed4c5a78091271f788d58dedcd94f6/
Threat name:
Win32.Downloader.Zload
Create hunting rule
Status:
Malicious
First seen:
2021-08-12 10:39:40 UTC
AV detection:
13 of 27 (48.15%)
Threat level:
  3/5
Verdict:
malicious
Label(s):
zloader
Create hunting rule
Similar samples:
12e5c221195f7d0a47b98b5d5fff26ea8fc4ad4f76f1c21f47e3a73102f18c59
ZLoader
24c57cf9a9fd72827ced5f95796cf333089f076c660bf06b5e7d071a4d5fc102
ZLoader
2aad576a107cd5cb031c13a85f8403a3b0e377a608a1af77f6e5607295bd54eb
ZLoader
481af12b4e027b76b68c817c3cb806291f52042d3b5dce2e9f073408f596e206
ZLoader
607a091d00b4660179f3b9c85bf1cd66edf3a2bc6bfcd794e60030b67363464c
ZLoader
9d26e19b8fc5819b634397d48183637bacc9e1c62d8b1856b8116141cb8b4000
ZLoader
9ef6c5467fd80274e6a37e2883a5e83a894cf2148ce37bf0adb1e884acbc4c0b
ZLoader
b250b1ccb8194ce1ccc86b4a88bd7279f6804fac990758e95d203fdd1d97dcc2
ZLoader
cbf6848b72b118e090953347982de71cfe1510dfdc4affdb1ee4d5d62af428d6
ZLoader
f1b22c0b6c144d82a0e470b2c6a649135a4f212ade39c8135e0273ec100ff34c
ZLoader
+ 89 additional samples on MalwareBazaar
Result
Malware family:
zloader
Create hunting rule
Score:
  10/10
Tags:
family:zloader botnet:vasja campaign:vasja botnet trojan
Link:
https://tria.ge/reports/210812-z8md46np2j/
Behaviour
Suspicious use of WriteProcessMemory
Zloader, Terdot, DELoader, ZeusSphinx
Malware Config
C2 Extraction:
https://iqowijsdakm.com/gate.php
https://wiewjdmkfjn.com/gate.php
https://dksaoidiakjd.com/gate.php
https://iweuiqjdakjd.com/gate.php
https://yuidskadjna.com/gate.php
https://olksmadnbdj.com/gate.php
https://odsakmdfnbs.com/gate.php
https://odsakjmdnhsaj.com/gate.php
https://odjdnhsaj.com/gate.php
https://odoishsaj.com/gate.php
Unpacked files
SH256 hash:
5fbd1a72e0df7f45bc5146eb8bbb5a744610c6c554c7619e92b65589051e8c9a
MD5 hash:
d16d606c0bfff820e258a62900c2741f
SHA1 hash:
06400a93e03fd57656b727bba202cf86e4e58c3b
Link:
https://www.unpac.me/results/6419a617-b982-411d-b3c1-01116b3fa979/
SH256 hash:
cdaca5b6aabd92a7b782c2d7b250cbc1b2ed4c5a78091271f788d58dedcd94f6
MD5 hash:
a9dd9b9eff47af724436e2abdcd5ce6c
SHA1 hash:
1a9c9258f0345f5edddd933a7bd15ec42be51f8e
Link:
https://www.unpac.me/results/6419a617-b982-411d-b3c1-01116b3fa979/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Suspicious File
Score:
0.30
Link:
https://yomi.yoroi.company/submissions/cdaca5b6aabd92a7b782c2d7b250cbc1b2ed4c5a78091271f788d58dedcd94f6

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

ZLoader

Executable exe cdaca5b6aabd92a7b782c2d7b250cbc1b2ed4c5a78091271f788d58dedcd94f6

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/1524412/
  
Delivery method
Distributed via web download
Cape
Cape
https://www.capesandbox.com/analysis/178739/

Comments