🤲🏼 NEW | abuse.ch Community Hub! Earn recognition 🏅 for the malware intelligence you share, climb the leaderboards 📈, and connect with like-minded contributors who share your hunting focus 🤝. Ready to unlock your profile? Go to the Community Hub →

MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 f0b6c677bac2de611e0866e849cebd64ec5454885fdd7be5bf0c1c5a17846e3a. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


ZLoader


Vendor detections: 9


Intelligence 9 IOCs YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: f0b6c677bac2de611e0866e849cebd64ec5454885fdd7be5bf0c1c5a17846e3a
SHA3-384 hash: cb4bdb38c466aad77658b3545fa101f4fab5c47af0cf3937a3764f5246c67202d15ed543f28168de5303e6e713c4a32a
SHA1 hash: 99644ab0f8d4dde1eb11b7ff88ebd66b21d73f24
MD5 hash: ca0376cce08c82a5d4c476c4922c4779
humanhash: december-single-leopard-delta
File name:ca.dll
Download: download sample
Signature ZLoader
Create hunting rule
File size:1'794'160 bytes
First seen:2022-01-06 10:53:46 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash af5ed7f9a80335060f22b30a9dacadee (1 x ZLoader)
ssdeep 6144:VFz/ixnFRogIONwTUFuEtfuKgoffgjgabzw4k1Hfl4tm8f4e0SbLVdJBdFw:VtYnfaSft8zw1GAm7BdF
TLSH T1BD8528535F134F59D52A4D349116B3AA473CEE9AA450ABB3A1B37701FE393F83C181A8
File icon (PE):PE icon
dhash icon 70c8dacaa694c870 (1 x CryptBot, 1 x Quakbot, 1 x ZLoader)
Reporter JoulK
Tags:dll exe ZLoader

Intelligence

File Origin
# of uploads :
1
# of downloads :
285
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
ca.dll
Verdict:
No threats detected
Analysis date:
2022-01-06 10:59:00 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/cecac3db-2ed1-4127-b432-57278d29e230

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/217547/
Detection(s):
SecuriteInfo.com.Trojan.SpyBot.1031.20018.15139.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Searching for the window
Launching a service
Creating a file
Creating a file in the %temp% directory
Delayed reading of the file
DNS request
Delayed writing of the file
Creating a file in the system32 subdirectories
Creating a file in the Program Files subdirectories
Verdict:
Suspicious
Threat level:
  5/10
Confidence:
100%
Tags:
anti-debug evasive overlay packed
Link:
https://www.filescan.io/uploads/61d6ca50135d97804c0f353c/reports/9e81da1c-f6dc-4d7c-9f89-e8806c4ef8db/overview
Malware family:
Zloader
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/9cf18149-161c-4e01-8dda-9fe3465619ee
Result
Threat name:
ZLoader
Create hunting rule
Detection:
malicious
Classification:
troj
Score:
80 / 100
Link:
https://www.joesandbox.com/analysis/916252
Signature
C2 URLs / IPs found in malware configuration
Found malware configuration
Machine Learning detection for sample
Multi AV Scanner detection for submitted file
PE file has a writeable .text section
Sigma detected: Suspicious Call by Ordinal
Yara detected ZLoader
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 548731 Sample: ca.dll Startdate: 06/01/2022 Architecture: WINDOWS Score: 80 16 asdfghdsajkl.com/gate.php unknown unknown 2->16 18 daksjuggdhwa.com/gate.php unknown unknown 2->18 20 8 other IPs or domains 2->20 22 Found malware configuration 2->22 24 Multi AV Scanner detection for submitted file 2->24 26 Yara detected ZLoader 2->26 28 4 other signatures 2->28 8 loaddll32.exe 1 2->8         started        signatures3 process4 process5 10 cmd.exe 1 8->10         started        12 rundll32.exe 1 8->12         started        process6 14 rundll32.exe 10->14         started       
Detection:
zloader
Create hunting rule
Link:
https://mwdb.cert.pl/sample/f0b6c677bac2de611e0866e849cebd64ec5454885fdd7be5bf0c1c5a17846e3a/
Threat name:
Win32.Downloader.ZLoader
Create hunting rule
Status:
Malicious
First seen:
2021-11-30 11:07:33 UTC
File Type:
PE (Dll)
Extracted files:
19
AV detection:
23 of 28 (82.14%)
Threat level:
  3/5
Verdict:
malicious
Result
Malware family:
zloader
Create hunting rule
Score:
  10/10
Tags:
family:zloader botnet:personal botnet:return campaign:personal campaign:return botnet trojan
Link:
https://tria.ge/reports/220106-mzj71abbf4/
Behaviour
Discovers systems in the same network
Gathers network information
Runs net.exe
Suspicious use of WriteProcessMemory
Zloader, Terdot, DELoader, ZeusSphinx
Malware Config
C2 Extraction:
https://asdfghdsajkl.com/gate.php
https://lkjhgfgsdshja.com/gate.php
https://kjdhsasghjds.com/gate.php
https://kdjwhqejqwij.com/gate.php
https://iasudjghnasd.com/gate.php
https://daksjuggdhwa.com/gate.php
https://dkisuaggdjhna.com/gate.php
https://eiqwuggejqw.com/gate.php
https://dquggwjhdmq.com/gate.php
https://djshggadasj.com/gate.php
https://iqowijsdakm.com/gate.php
https://wiewjdmkfjn.com/gate.php
https://dksaoidiakjd.com/gate.php
https://iweuiqjdakjd.com/gate.php
https://yuidskadjna.com/gate.php
https://olksmadnbdj.com/gate.php
https://odsakmdfnbs.com/gate.php
https://odsakjmdnhsaj.com/gate.php
https://odjdnhsaj.com/gate.php
https://odoishsaj.com/gate.php
Unpacked files
SH256 hash:
e63fc27f66f840931e0605be01a6068ad070d710134321c266acfc74c5cfae75
MD5 hash:
0f3ec9a9ceaf216d0a223a256fc0c1be
SHA1 hash:
426e23eb3061981f5304ad7a073fdb9a7a03ca52
Link:
https://www.unpac.me/results/70d4af53-7847-46cd-96e3-154ea1aaefbe/
SH256 hash:
f0b6c677bac2de611e0866e849cebd64ec5454885fdd7be5bf0c1c5a17846e3a
MD5 hash:
ca0376cce08c82a5d4c476c4922c4779
SHA1 hash:
99644ab0f8d4dde1eb11b7ff88ebd66b21d73f24
Link:
https://www.unpac.me/results/70d4af53-7847-46cd-96e3-154ea1aaefbe/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/f0b6c677bac2de611e0866e849cebd64ec5454885fdd7be5bf0c1c5a17846e3a

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:INDICATOR_KB_CERT_1f3216f428f850be2c66caa056f6d821
Create hunting rule
Author:ditekSHen
Description:Detects executables signed with stolen, revoked or invalid certificates

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/217547/

Comments