MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 dfe36cb1322dbfc64ef8bb535b5a797be2fc011ebd0027c4a4b4287e525cb7aa. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


ZLoader


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: dfe36cb1322dbfc64ef8bb535b5a797be2fc011ebd0027c4a4b4287e525cb7aa
SHA3-384 hash: c341263e493efbf1e2a36f2851d465d5e0400891cc3cb5fdc15c1a774026903a3181dfc4461b89698c8a86eb600e9ddf
SHA1 hash: 66fc4febed55f6acbbc0704b6f77358a3d15d496
MD5 hash: 0c3eeec9eeaa93326f275b6213f557d7
humanhash: may-high-hotel-golf
File name:zte(1).dll
Download: download sample
Signature ZLoader
Create hunting rule
File size:484'864 bytes
First seen:2020-06-16 07:41:50 UTC
Last seen:Never
File type:DLL dll
MIME type:application/x-dosexec
imphash 8576f2eda7a30aeed43fccdbadabc440 (16 x Gozi, 10 x ZLoader)
ssdeep 12288:T2s6153+0KPnJHFlswhjmoUYtIdySZYBk:TZ8Vl8jmotI2S
Threatray 295 similar samples on MalwareBazaar
TLSH B3A4D0E25940B2B0D14BC97E9420B1B681F97C2A7F549180F98B47B735372FAA994FC3
Reporter JAMESWT_WT
Tags:ZLoader

Intelligence

File Origin
# of uploads :
1
# of downloads :
72
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/10648/
Detection(s):
SecuriteInfo.com.Trojan.DownLoader33.50034.29723.12589.UNOFFICIAL
Create hunting rule

PUA.Win.Downloader.Aiis-6803892-0
Create hunting rule

Gathering data
Threat name:
Win32.Trojan.ZLoader
Create hunting rule
Status:
Malicious
First seen:
2020-06-16 07:43:06 UTC
File Type:
PE (Dll)
Extracted files:
1
AV detection:
25 of 29 (86.21%)
Threat level:
  5/5
Verdict:
malicious
Label(s):
gozi
Create hunting rule
zloader
Create hunting rule
Similar samples:
1fb1ee793145620cc4dd10fe67473b7de1e015a3328f86581ec994738fa9e978
ZLoader
3c774090ba37e891c0268796302378c8340f29c3d5dd1be52395abfd2c126bea
ZLoader
8179cb45ba2d6df0d25f9e1f382c5b9e8b9b703e4404fa19a9002c78418dedea
ZLoader
8987107698e6ef8ca9a6804206ea40fcaf9f3869d3e9569e9fbfab2621b69126
ZLoader
8cef73774b9cbc3a63d6212cc1361b9b77c3dfc05d815730e2132535ebadaaa5
ZLoader
9ce2908edf0994f493926514628054634858340fb73f219c38c013f34dd9a429
ZLoader
aa50192a745ed41728a8f5f4519466c072656ccbbe4a789ef2150ecb2e407789
ZLoader
c28329c132b846b91caaa0c8fc5f8e5b6bf78275772ceee6bea7970bf3de8050
ZLoader
d4678fbba0cf64f91a7844884e17126a2c4095c478d52fe2fa549692b557cca7
ZLoader
e66c91dc125d340382e6f7f19b30d9b956d6a35cf964e3b9bd7a83d499b7cf8d
ZLoader
+ 285 additional samples on MalwareBazaar
Result
Malware family:
zloader
Create hunting rule
Score:
  10/10
Tags:
trojan botnet family:zloader persistence evasion spyware
Link:
https://tria.ge/reports/200624-zzhv9hzkna/
Behaviour
Suspicious use of WriteProcessMemory
Suspicious use of AdjustPrivilegeToken
Suspicious use of SetThreadContext
Adds Run entry to start application
Modifies system certificate store
Blacklisted process makes network request
Zloader, Terdot, DELoader, ZeusSphinx
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

ZLoader

DLL dll dfe36cb1322dbfc64ef8bb535b5a797be2fc011ebd0027c4a4b4287e525cb7aa

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/385275/
  
Delivery method
Distributed via web download
  
URLhaus
https://urlhaus.abuse.ch/url/385323/
Cape
Cape
https://www.capesandbox.com/analysis/10648/

Comments