🤲🏼 NEW | abuse.ch Community Hub! Earn recognition 🏅 for the malware intelligence you share, climb the leaderboards 📈, and connect with like-minded contributors who share your hunting focus 🤝. Ready to unlock your profile? Go to the Community Hub →

MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 d73871ac75496c6892613fbcda7bb4ad9f3bc868a134933b640699f8d8da53ca. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


ZLoader


Vendor detections: 8


Intelligence 8 IOCs YARA 2 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: d73871ac75496c6892613fbcda7bb4ad9f3bc868a134933b640699f8d8da53ca
SHA3-384 hash: 1ff41fa03251279b3b8eb71569302f3afb65df764183dcfc543148bdda9304545da536af272a9b4f8935b81f02d2a5d1
SHA1 hash: 3930debcaa8745b5a66f55bae9190423b5313fbd
MD5 hash: 75d2fed737e66dd5f524043bd0e99b55
humanhash: artist-six-echo-neptune
File name:order_00588_pay.rar
Download: download sample
Signature ZLoader
Create hunting rule
File size:299'008 bytes
First seen:2020-11-01 12:39:04 UTC
Last seen:2020-11-01 14:51:32 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash 22c87ff9d53c8eae0251c1eaef3e8242 (3 x ZLoader, 2 x RedLineStealer)
ssdeep 6144:p6dkR9l41itC9s6/P5unktruA8ehzIFbf/Vx:a0PCs6sUrEmOF
TLSH 9554BF1173E1C572C09644315861E2B0533ABC62A974894F7BD8EF6B3E322D1EBB635E
Reporter nao_sec
Tags:FalloutEK PseudoGate ZLoader

Intelligence

File Origin
# of uploads :
2
# of downloads :
188
Origin country :
n/a
Vendor Threat Intelligence
Detection:
Zloader
Create hunting rule
Link:
https://www.capesandbox.com/analysis/81650/
Detection(s):
SecuriteInfo.com.Artemis75D2FED737E6.9836.UNOFFICIAL
Create hunting rule

Result
Verdict:
Clean
Maliciousness:

Behaviour
Creating a file in the %temp% directory
Deleting a recently created file
Replacing files
Delayed writing of the file
Delayed reading of the file
Sending a UDP request
Result
Threat name:
Unknown
Detection:
malicious
Classification:
evad
Score:
64 / 100
Link:
https://www.joesandbox.com/analysis/517725
Signature
Detected unpacking (changes PE section rights)
Detected unpacking (overwrites its own PE header)
Initial sample is a PE file and has a suspicious name
Machine Learning detection for sample
Behaviour
Behavior Graph:
Download SVG
Detection:
zloader
Create hunting rule
Link:
https://mwdb.cert.pl/sample/d73871ac75496c6892613fbcda7bb4ad9f3bc868a134933b640699f8d8da53ca/
Threat name:
Win32.Trojan.Wacatac
Create hunting rule
Status:
Malicious
First seen:
2020-11-01 12:41:04 UTC
AV detection:
25 of 28 (89.29%)
Threat level:
  5/5
Result
Malware family:
zloader
Create hunting rule
Score:
  10/10
Tags:
family:zloader botnet:r1 campaign:r1 botnet trojan
Link:
https://tria.ge/reports/201101-c65j86bnzj/
Behaviour
Zloader, Terdot, DELoader, ZeusSphinx
Malware Config
C2 Extraction:
https://notsweets.net/LKhwojehDgwegSDG/gateJKjdsh.php
https://olpons.com/LKhwojehDgwegSDG/gateJKjdsh.php
https://karamelliar.org/LKhwojehDgwegSDG/gateJKjdsh.php
https://dogrunn.com/LKhwojehDgwegSDG/gateJKjdsh.php
https://azoraz.net/LKhwojehDgwegSDG/gateJKjdsh.php
Unpacked files
SH256 hash:
d73871ac75496c6892613fbcda7bb4ad9f3bc868a134933b640699f8d8da53ca
MD5 hash:
75d2fed737e66dd5f524043bd0e99b55
SHA1 hash:
3930debcaa8745b5a66f55bae9190423b5313fbd
Link:
https://www.unpac.me/results/ba5350d4-f9f9-4254-bef3-a32fa3999c40/
SH256 hash:
a620e4252a6fd017412070f9a6c5cb4d86776ee2fe2721813b186fbc7bbc056e
MD5 hash:
09107f0f1f40abf1554fdeb04ad41c72
SHA1 hash:
c9f1ba2224593dafb0528ef549e5ea6a160e023e
Detections:
win_zloader_a0
Create hunting rule
win_zloader_auto
Create hunting rule
Link:
https://www.unpac.me/results/ba5350d4-f9f9-4254-bef3-a32fa3999c40/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/d73871ac75496c6892613fbcda7bb4ad9f3bc868a134933b640699f8d8da53ca

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:win_zloader_a0
Create hunting rule
Author:Slavo Greminger, SWITCH-CERT
Rule name:win_zloader_auto
Create hunting rule
Author:Felix Bilstein - yara-signator at cocacoding dot com
Description:autogenerated rule brought to you by yara-signator

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/81650/

Comments