MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 fb55aa4029e826e42520861cc82a8db4a3568f1d2b5fe6f39d7bf870ec0005f9. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


ZLoader


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: fb55aa4029e826e42520861cc82a8db4a3568f1d2b5fe6f39d7bf870ec0005f9
SHA3-384 hash: 72495fb58bfa1f4b706fc53f2df1f4ef348bb60297983f62f37db2b978f5b71b25f7a8103afd85f194bf5fa1bed18217
SHA1 hash: ede00a9c20689c8c6dc5fa301b46c2a74ebe01af
MD5 hash: 1d03a39c5b1f99fc9c33bc4a9811cf0f
humanhash: five-fillet-apart-low
File name:SecuriteInfo.com.Generic.mg.1d03a39c5b1f99fc.9372
Download: download sample
Signature ZLoader
Create hunting rule
File size:483'840 bytes
First seen:2020-04-24 23:56:38 UTC
Last seen:Never
File type:DLL dll
MIME type:application/x-dosexec
imphash b3010a68d5712ce0df006249937b2c0a (4 x ZLoader)
ssdeep 12288:zayC7dYtaR2FV9DAuuasxaunyIVTyMAzj:zxHta+jmnlVTIzj
Threatray 66 similar samples on MalwareBazaar
TLSH 4BA4BF113AA8C1FEE4A95536AD69D9FC8558BC71CF70A8933BD0BF0F76303D09624626
Reporter SecuriteInfoCom
Tags:ZLoader

Intelligence

File Origin
# of uploads :
1
# of downloads :
86
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Generic.mg.1d03a39c5b1f99fc.9372.UNOFFICIAL
Create hunting rule

PUA.Win.Downloader.Aiis-6803892-0
Create hunting rule

Gathering data
Threat name:
Win32.Trojan.Kryptik
Create hunting rule
Status:
Malicious
First seen:
2020-04-25 03:50:07 UTC
File Type:
PE (Dll)
Extracted files:
1
AV detection:
23 of 31 (74.19%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=7nk2uqbj5atoijjaqyomqkunwsrvndy5fnp6n445pp4hb3aaax4q._file
Verdict:
malicious
Label(s):
gozi
Create hunting rule
Similar samples:
213ccc660b77060313c9842e1d2d0215b5909235d54140daa21f0110c50e4715
ZLoader
414bb1af4fbb618c4889d69144c7f66591c6e5294d0ab3b7ea8b774946977cf2
ZLoader
50119da56e84ae4baa207a9391a0143fe5aa66c212aeba08e2d6d864af0a0d83
ZLoader
75b24a04b7ddddd036a8e677061e2cd86bc74f147f4b59de463964476db5f003
ZLoader
92f61cc6548277705585cc0c28d553093323d802a1d0d2e9fe618ebeaa6752fa
ZLoader
be3d1522f968ad7cc46a996a64b5e5be8044075f6bd1784046e46671bf416b45
ZLoader
d538dfafbdf6ac115c24dbdd68c65dbef6460808dd2c4f3fc01d5e15bfc2f902
ZLoader
e39fd52523f742331dc20ee90a051e456561481ef4c360a40ffaac292cb6c37b
ZLoader
e3f6a7a2d6628adf2956c3c1f387c2bd178b48e170a71368ae3e7f8c20b8e213
ZLoader
e93b9a00886b7a569dc09337361d246c4ac74d3a061579ea4ad33b9ad19f7bde
ZLoader
+ 56 additional samples on MalwareBazaar
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

ZLoader

DLL dll fb55aa4029e826e42520861cc82a8db4a3568f1d2b5fe6f39d7bf870ec0005f9

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/350658/
  
Delivery method
Distributed via web download

BLint

The following table provides more information about this file using BLint. BLint is a Binary Linter to check the security properties, and capabilities in executables.

Findings
IDTitleSeverity
CHECK_AUTHENTICODEMissing Authenticodehigh
CHECK_DLL_CHARACTERISTICSMissing dll Security Characteristics (HIGH_ENTROPY_VA)high
Reviews
IDCapabilitiesEvidence
AUTH_APIManipulates User AuthorizationADVAPI32.dll::AllocateAndInitializeSid
ADVAPI32.dll::FreeSid
ADVAPI32.dll::InitializeSecurityDescriptor
SECURITY_BASE_APIUses Security Base APIADVAPI32.dll::SetSecurityDescriptorDacl
ADVAPI32.dll::SetSecurityDescriptorGroup
ADVAPI32.dll::SetSecurityDescriptorOwner
WIN32_PROCESS_APICan Create Process and ThreadsKERNEL32.dll::CreateProcessA
ADVAPI32.dll::OpenProcessToken
ADVAPI32.dll::OpenThreadToken
KERNEL32.dll::CloseHandle
WIN_BASE_APIUses Win Base APIKERNEL32.dll::TerminateProcess
KERNEL32.dll::LoadLibraryExW
KERNEL32.dll::GetStartupInfoW
KERNEL32.dll::GetCommandLineA
WIN_BASE_EXEC_APICan Execute other programsKERNEL32.dll::WriteConsoleW
KERNEL32.dll::ReadConsoleW
KERNEL32.dll::SetStdHandle
KERNEL32.dll::GetConsoleCP
KERNEL32.dll::GetConsoleMode
WIN_BASE_IO_APICan Create FilesKERNEL32.dll::CreateFileW
KERNEL32.dll::GetSystemDirectoryA
KERNEL32.dll::GetFileAttributesA
WIN_BASE_USER_APIRetrieves Account InformationADVAPI32.dll::LookupPrivilegeValueA
WIN_REG_APICan Manipulate Windows RegistryADVAPI32.dll::RegCreateKeyExA
ADVAPI32.dll::RegDeleteKeyA
ADVAPI32.dll::RegOpenKeyA
ADVAPI32.dll::RegOpenKeyExA
ADVAPI32.dll::RegQueryValueExA
ADVAPI32.dll::RegSetValueExA
WIN_SVC_APICan Manipulate Windows ServicesADVAPI32.dll::OpenSCManagerA
ADVAPI32.dll::OpenServiceA
ADVAPI32.dll::QueryServiceStatus
ADVAPI32.dll::RegisterServiceCtrlHandlerA
ADVAPI32.dll::StartServiceCtrlDispatcherA

Comments