MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 e7f1b2d2601e9a6427a155a3599614c09c9edaae7eb8f10b81e1f3e117717157. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


ZLoader


Vendor detections: 6


Intelligence 6 IOCs YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: e7f1b2d2601e9a6427a155a3599614c09c9edaae7eb8f10b81e1f3e117717157
SHA3-384 hash: 97de2da3028bfd37bf5995f0f1ade2aaa294d9bed98a62c4de31437ec3f2e4044af26c59265e8d064cf8627d11a3521b
SHA1 hash: 403c6a9e7159480ba75f4250f2d946226de92d4b
MD5 hash: a37a8840e9e8d07c73861a1353013ba2
humanhash: winner-johnny-florida-delta
File name:SecuriteInfo.com.Win32.Kryptik.HENB.18157
Download: download sample
Signature ZLoader
Create hunting rule
File size:592'896 bytes
First seen:2020-06-30 03:36:52 UTC
Last seen:Never
File type:DLL dll
MIME type:application/x-dosexec
imphash 7af8fa00ad6b21ee3cbd72c090c0bdaf (8 x ZLoader)
ssdeep 12288:AbQJGj68MhvrWZ0b/lyNLFMpZF6D1+FVoeTmuMsxJWjj7E2K9:AbQJs68+PgNB4v6O1TmMxgjj7nK
Threatray 137 similar samples on MalwareBazaar
TLSH 6EC49D01B690D138F4FB45B49A76C1ADAA387D605B3488CBB7C52E9F5B246E0ED31713
Reporter SecuriteInfoCom
Tags:ZLoader

Intelligence

File Origin
# of uploads :
1
# of downloads :
77
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/16751/
Detection(s):
SecuriteInfo.com.Win32.Kryptik.HENB.18157.UNOFFICIAL
Create hunting rule

PUA.Win.Downloader.Aiis-6803892-0
Create hunting rule

Detection:
zloader
Create hunting rule
Link:
https://mwdb.cert.pl/sample/e7f1b2d2601e9a6427a155a3599614c09c9edaae7eb8f10b81e1f3e117717157/
Threat name:
Win32.Trojan.ZLoader
Create hunting rule
Status:
Malicious
First seen:
2020-06-30 03:38:05 UTC
AV detection:
22 of 31 (70.97%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=47y3futad2ngij5bkwrvtfquycoj5wvop24pcc4b4hz6cf3roflq._file
Verdict:
malicious
Label(s):
gozi
Create hunting rule
Similar samples:
0573d56a84aac658edac1e93d08390c1a8378ed2d801b2460ac89a8ef643eb7d
ZLoader
17ddc83d49b6cd1d511e8c5498c44d8b4bdbbb69b13011a180f8bded117ff2f7
ZLoader
3326d4607b164078735ee55313992c18e83e6b87b75faf350b8c61a99eb2b659
ZLoader
3bf8fbdad095013493d1b90f5c82880dc57145dfbb54fdf225ded88ba6b1618b
ZLoader
3dd800b875aa0ef2fa0923babdd4b162555a1c3ff3c58e9291d45fff82389816
ZLoader
455c21fbac342659cd4b5cc162772117cce60f6b59f04dba0dd4327868a428eb
ZLoader
b7a306bd407cca438202bfb3b92abff60f959418c7fd129487a6510554ff5706
ZLoader
b8a7600b813dbd100629f8353a30592f21163319ab6229b1b46c2693483b2ae1
ZLoader
ca755b8915cb1025b4b5748e12cd7d3cbdccbcf90fd5986c911b066043d6d136
ZLoader
f28dd082013ee7df2f5956c4e8791e863e575aa64071af9a910826bc12d27acb
ZLoader
+ 127 additional samples on MalwareBazaar
Result
Malware family:
zloader
Create hunting rule
Score:
  10/10
Tags:
trojan botnet family:zloader evasion spyware
Link:
https://tria.ge/reports/200630-a9v2wz3hds/
Behaviour
Suspicious use of WriteProcessMemory
Suspicious use of AdjustPrivilegeToken
Suspicious behavior: EnumeratesProcesses
Suspicious use of SetThreadContext
Modifies system certificate store
Blacklisted process makes network request
Zloader, Terdot, DELoader, ZeusSphinx
Suspicious use of NtCreateUserProcessOtherParentProcess
Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:win_unidentified_023_auto
Create hunting rule
Author:Felix Bilstein - yara-signator at cocacoding dot com
Description:autogenerated rule brought to you by yara-signator

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/16751/

Comments