MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 eecaf5677c5c21d268261eef35a819549dda3c454e9b60e368070aa3bfd2f54c. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


ZLoader


Vendor detections: 9


Intelligence 9 IOCs YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: eecaf5677c5c21d268261eef35a819549dda3c454e9b60e368070aa3bfd2f54c
SHA3-384 hash: 9339f729f5545dd3454991dcbc2fb6c139c1ab4aa1db2e20422b419aa5ae9f29ffadb643297424cb403ca332c7985b46
SHA1 hash: 7c5357f32a0a3afe7cf840722a7968db8f82fc71
MD5 hash: a91492c67615ed6267a2a4e9969373ca
humanhash: ink-kansas-item-batman
File name:ywosi.bin
Download: download sample
Signature ZLoader
Create hunting rule
File size:159'744 bytes
First seen:2020-09-02 16:01:20 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash 9be1f63ce6720dd2b384f164ef55de40 (1 x ZLoader)
ssdeep 3072:3QsHCIhiNUSbzYYf5om0C4M1tGATq3WRLI1ZJaErys3T7jho2wiIUEO2pZ:9iIhizn5fpz7HsWRLwaa93TRfI7
Threatray 2 similar samples on MalwareBazaar
TLSH D9F317029854C131F91104716C9DB77E5C6AC32E3B229AABCBA1CCF4EFDC5B1626E25D
Reporter JAMESWT_WT
Tags:ZLoader

Intelligence

File Origin
# of uploads :
1
# of downloads :
115
Origin country :
n/a
Vendor Threat Intelligence
Gathering data
Detection(s):
SecuriteInfo.com.Variant.Razy.593882.4110.3883.UNOFFICIAL
Create hunting rule

Result
Verdict:
Suspicious
Maliciousness:

Behaviour
Creating a window
Running batch commands
Creating a process with a hidden window
Launching the process to interact with network services
Launching the default Windows debugger (dwwin.exe)
Sending a UDP request
Launching a process
Result
Threat name:
Unknown
Detection:
malicious
Classification:
spre.troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/457693
Signature
Allocates memory in foreign processes
Antivirus / Scanner detection for submitted sample
Antivirus detection for dropped file
Antivirus detection for URL or domain
Contains functionality to inject code into remote processes
Contains VNC / remote desktop functionality (version string found)
Injects a PE file into a foreign processes
Injects code into the Windows Explorer (explorer.exe)
Machine Learning detection for dropped file
Machine Learning detection for sample
Modifies the prolog of user mode functions (user mode inline hooks)
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Performs a network lookup / discovery via net view
Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)
Tries to harvest and steal browser information (history, passwords, etc)
Tries to steal Mail credentials (via file access)
Uses ipconfig to lookup or modify the Windows network settings
Uses net.exe to modify the status of services
Writes to foreign memory regions
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 281234 Sample: ywosi.bin Startdate: 02/09/2020 Architecture: WINDOWS Score: 100 50 Snort IDS alert for network traffic (e.g. based on Emerging Threat rules) 2->50 52 Antivirus detection for URL or domain 2->52 54 Antivirus detection for dropped file 2->54 56 10 other signatures 2->56 9 ywosi.exe 2->9         started        process3 signatures4 58 Contains functionality to inject code into remote processes 9->58 60 Writes to foreign memory regions 9->60 62 Allocates memory in foreign processes 9->62 12 msiexec.exe 2 46 9->12         started        process5 dnsIp6 46 lastcost2020.com 217.8.117.105, 49749, 49750, 49751 CREXFEXPEX-RUSSIARU Russian Federation 12->46 44 C:\Users\user\AppData\Roaming\...\qyylpuy.exe, PE32 12->44 dropped 64 Tries to steal Mail credentials (via file access) 12->64 66 Injects code into the Windows Explorer (explorer.exe) 12->66 68 Tries to harvest and steal browser information (history, passwords, etc) 12->68 70 3 other signatures 12->70 17 cmd.exe 1 12->17         started        20 cmd.exe 1 12->20         started        22 cmd.exe 1 12->22         started        24 2 other processes 12->24 file7 signatures8 process9 signatures10 48 Performs a network lookup / discovery via net view 17->48 26 conhost.exe 17->26         started        28 net.exe 1 17->28         started        30 conhost.exe 20->30         started        32 net.exe 1 20->32         started        34 net.exe 1 22->34         started        36 conhost.exe 22->36         started        38 ipconfig.exe 1 24->38         started        40 conhost.exe 24->40         started        process11 process12 42 net1.exe 1 34->42         started       
Detection:
zloader
Create hunting rule
Link:
https://mwdb.cert.pl/sample/eecaf5677c5c21d268261eef35a819549dda3c454e9b60e368070aa3bfd2f54c/
Threat name:
Win32.Infostealer.Dridex
Create hunting rule
Status:
Malicious
First seen:
2020-09-02 05:19:33 UTC
File Type:
PE (Exe)
AV detection:
23 of 29 (79.31%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=53fpkz34lqq5e2bgd3xtlkazkso5upcfj2nwby3ia4fkhp6s6vga._file
Verdict:
malicious
Label(s):
zloader
Create hunting rule
Similar samples:
3712c1a9e9ab864ee28897d0802179db4a2f664f61629f1154437640be377530
ZLoader
b866a18458d22f3c362eb9db308ccbbe80ad1a1ef04d9f1c8ba6d3c66ccd4971
ZLoader
Result
Malware family:
zloader
Create hunting rule
Score:
  10/10
Tags:
family:zloader
Link:
https://tria.ge/reports/200902-8dh3wydmhx/
Behaviour
Zloader family
Malware Config
C2 Extraction:
http://lastcost2020.com/LKhwojehDgwegSDG/gateJKjdsh.php
http://lastcost2020.in/LKhwojehDgwegSDG/gateJKjdsh.php
http://lastcost2020.info/LKhwojehDgwegSDG/gateJKjdsh.php
http://lastcost2020.net/LKhwojehDgwegSDG/gateJKjdsh.php
http://lastcost2020.org/LKhwojehDgwegSDG/gateJKjdsh.php
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
ZLoader
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/eecaf5677c5c21d268261eef35a819549dda3c454e9b60e368070aa3bfd2f54c

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:win_zloader_auto
Create hunting rule
Author:Felix Bilstein - yara-signator at cocacoding dot com
Description:autogenerated rule brought to you by yara-signator

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

ZLoader

zip f01903eb23820755fbb7a0c9e820798691400d7eeee17d0e0d87a6636d149c6f

ZLoader

Executable exe eecaf5677c5c21d268261eef35a819549dda3c454e9b60e368070aa3bfd2f54c

(this sample)

  
Dropped by
SHA256 f01903eb23820755fbb7a0c9e820798691400d7eeee17d0e0d87a6636d149c6f
  
Dropped by
MD5 32b0e3647a49759585af188a7ef77c68
Cape
Cape
https://www.capesandbox.com/analysis/54463/

Comments