Overview

overview

10

Static

static

10

zen.win-sp...al.dll

windows10-2004-x64

5

zen.win-sp...org.js

windows7-x64

3

zen.win-sp...org.js

windows10-2004-x64

3

zen.win-sp...org.js

windows7-x64

3

zen.win-sp...org.js

windows10-2004-x64

3

zen.win-sp...efs.js

windows7-x64

3

zen.win-sp...efs.js

windows10-2004-x64

3

zen.win-sp...l3.dll

windows10-2004-x64

1

zen.win-sp...cs.dll

windows10-2004-x64

1

zen.win-sp...ey.dll

windows10-2004-x64

1

zen.win-sp...ts.dll

windows10-2004-x64

1

zen.win-sp...bs.dll

windows10-2004-x64

1

zen.win-sp...GL.dll

windows10-2004-x64

1

zen.win-sp...v2.dll

windows10-2004-x64

1

zen.win-sp...ec.dll

windows10-2004-x64

1

zen.win-sp...il.dll

windows10-2004-x64

1

zen.win-sp...ue.dll

windows10-2004-x64

1

zen.win-sp...40.dll

windows7-x64

1

zen.win-sp...40.dll

windows10-2004-x64

1

zen.win-sp...xy.exe

windows7-x64

1

zen.win-sp...xy.exe

windows10-2004-x64

1

zen.win-sp...er.dll

windows10-2004-x64

1

zen.win-sp...s3.dll

windows10-2004-x64

1

zen.win-sp...bi.dll

windows10-2004-x64

1

zen.win-sp...ts.dll

windows10-2004-x64

1

zen.win-sp...er.exe

windows10-2004-x64

3

zen.win-sp...er.exe

windows10-2004-x64

1

zen.win-sp...ng.exe

windows10-2004-x64

1

zen.win-sp...n3.dll

windows10-2004-x64

1

zen.win-sp...er.exe

windows7-x64

4

zen.win-sp...er.exe

windows10-2004-x64

4

$PLUGINSDIR/UAC.dll

windows7-x64

3

Sharing

Copy URL
Twitter E-mail

General

  • Target

    zen.win-specific.zip

  • Size

    94.7MB

  • MD5

    a9afb97d7b2380c20ed78b126a63688a

  • SHA1

    528383dd994d2c8f32f0718c054a85394c5ff687

  • SHA256

    3db2c1f543f255d87c37c3faa0dc3c4e20e0e939a20c58db4efad1bab9b55e9a

  • SHA512

    f9fbcab4df9d9254f59ef8fc148369e4a66242f92acd4941ab7aab5db5183b4dc213fce05dab4f736c9e149232c0fb1dec56dd264b1f1739e1934af3c3f1ff00

  • SSDEEP

    1572864:mWtIJ7vnXtdMGUpsGRNGQN1x0ZzJaJdPB661R+7cqP/Z+yi9+/k3OIkZ:mWu1XtGGUpLNN1IlqE6T6nZLiY/k3qZ

Score
10/10
bazarloader

Malware Config

Signatures

  • Bazar/Team9 Loader payload 1 IoCs
  • Bazarloader family
    bazarloader
  • Unsigned PE 1 IoCs

    Checks for missing Authenticode signature.

Files

  • zen.win-specific.zip
    .zip
  • zen.win-specific\zen\AccessibleMarshal.dll
    .dll regsvr32 windows:10 windows x64 arch:x64

    c0caa654a8ff511450dc30146e927410


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • zen.win-specific\zen\application.ini
  • zen.win-specific\zen\browser\VisualElements\PrivateBrowsing_150.png
    .png
  • zen.win-specific\zen\browser\VisualElements\PrivateBrowsing_70.png
    .png
  • zen.win-specific\zen\browser\VisualElements\VisualElements_150.png
    .png
  • zen.win-specific\zen\browser\VisualElements\VisualElements_70.png
    .png
  • zen.win-specific\zen\browser\features\[email protected]
    .js
  • zen.win-specific\zen\browser\features\[email protected]
    .zip .js polyglot
  • zen.win-specific\zen\browser\features\[email protected]
    .zip .js polyglot
  • zen.win-specific\zen\browser\features\[email protected]
    .zip .js polyglot
  • zen.win-specific\zen\browser\features\[email protected]
    .js
  • zen.win-specific\zen\browser\omni.ja
  • zen.win-specific\zen\defaults\pref\channel-prefs.js
  • zen.win-specific\zen\dependentlibs.list
  • zen.win-specific\zen\firefox.VisualElementsManifest.xml
  • zen.win-specific\zen\fonts\TwemojiMozilla.ttf
  • zen.win-specific\zen\freebl3.dll
    .dll windows:10 windows x64 arch:x64

    a2535afe3971a088ec9e65d2f3a58099


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • zen.win-specific\zen\gkcodecs.dll
    .dll windows:10 windows x64 arch:x64

    5a51063a046bbfdf4186e63cd6768c32


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • zen.win-specific\zen\gmp-clearkey\0.1\clearkey.dll
    .dll windows:10 windows x64 arch:x64

    9b98340b7b68c511a9f1a5ff234e15a8


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • zen.win-specific\zen\gmp-clearkey\0.1\manifest.json
  • zen.win-specific\zen\ipcclientcerts.dll
    .dll windows:10 windows x64 arch:x64

    2baf987589a7f30ffb84acde997c813f


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • zen.win-specific\zen\lgpllibs.dll
    .dll windows:10 windows x64 arch:x64

    30edc8330dd98982d6b215902e324f38


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • zen.win-specific\zen\libEGL.dll
    .dll windows:10 windows x64 arch:x64

    8ffe10dac57f92c85190369d82287d93


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • zen.win-specific\zen\libGLESv2.dll
    .dll windows:10 windows x64 arch:x64

    b721b8d0cbe957870ab3b11b5756909b


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • zen.win-specific\zen\mozavcodec.dll
    .dll windows:10 windows x64 arch:x64

    c0d21cd7cd8f19c77c1dcb7487c279b3


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • zen.win-specific\zen\mozavutil.dll
    .dll windows:10 windows x64 arch:x64

    f70a8571ed16bf88ae81e65650ec98ed


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • zen.win-specific\zen\mozglue.dll
    .dll windows:10 windows x64 arch:x64

    274210545facb74c4339f55c52f1e575


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • zen.win-specific\zen\msvcp140.dll
    .dll windows:6 windows x64 arch:x64

    118dde577a38119350ab495f68a0326f


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • zen.win-specific\zen\nmhproxy.exe
    .exe windows:6 windows x64 arch:x64

    a5cc79c72237e4d3ea13ea50f0c6199a


    Code Sign

    Headers

    Imports

    Sections

  • zen.win-specific\zen\notificationserver.dll
    .dll windows:10 windows x64 arch:x64

    603163895bc4d56a39107a50011d67c7


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • zen.win-specific\zen\nss3.dll
    .dll windows:10 windows x64 arch:x64

    a5204b7412e32b0cadf42461221418c9


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • zen.win-specific\zen\nssckbi.dll
    .dll windows:10 windows x64 arch:x64

    5040f5401cbef0593f7caf886c3c92d3


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • zen.win-specific\zen\omni.ja
  • zen.win-specific\zen\osclientcerts.dll
    .dll windows:10 windows x64 arch:x64

    e30cb35cef0294ace0b7e36dbd9d9330


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • zen.win-specific\zen\pingsender.exe
    .exe windows:10 windows x64 arch:x64

    c199bc60d38108a1744b5ff4625d24c6


    Code Sign

    Headers

    Imports

    Sections

  • zen.win-specific\zen\platform.ini
  • zen.win-specific\zen\plugin-container.exe
    .exe windows:10 windows x64 arch:x64

    45515c0ffa070314eed29dc15246524c


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • zen.win-specific\zen\precomplete
  • zen.win-specific\zen\private_browsing.VisualElementsManifest.xml
  • zen.win-specific\zen\private_browsing.exe
    .exe windows:10 windows x64 arch:x64

    e575f37fbcf305a828176ba505fd3472


    Code Sign

    Headers

    Imports

    Sections

  • zen.win-specific\zen\removed-files
  • zen.win-specific\zen\softokn3.dll
    .dll windows:10 windows x64 arch:x64

    47c11b6165364a32d291aef914d612e1


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • zen.win-specific\zen\uninstall\helper.exe
    .exe windows:4 windows x86 arch:x86

    6e7f9a29f2c85394521a08b9f31f6275


    Code Sign

    Headers

    Imports

    Sections

  • $EXEDIR/uninstaller.exe.nsis
  • $PLUGINSDIR/AccessControl.dll
    .dll windows:4 windows x86 arch:x86

    4f9ac94e28e29febec2ab9514477dad2


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/AppAssocReg.dll
    .dll windows:4 windows x86 arch:x86

    3c290133e6ebf9207ee785f8308f1159


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/ApplicationID.dll
    .dll windows:5 windows x86 arch:x86

    342181dc22e6d047b283267c677abe77


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/CityHash.dll
    .dll windows:4 windows x86 arch:x86

    720db9870d7edf191c6f2f6cfa752e0e


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/InvokeShellVerb.dll
    .dll windows:4 windows x86 arch:x86

    6e69df65bd2a5bb187e054e6154f54c2


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/PinToTaskbar.dll
    .dll windows:6 windows x86 arch:x86

    d4e6fc485e509e0a70d51be16c2e6a49


    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/ShellLink.dll
    .dll windows:5 windows x86 arch:x86

    45fa690faed482cb9bfd08458ed442ae


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/System.dll
    .dll windows:4 windows x86 arch:x86

    fc0224e99e736751432961db63a41b76


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/UAC.dll
    .dll windows:4 windows x86 arch:x86

    2a2e0e82c0dc9890f9201e8bd8ecbff2


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/liteFirewallW.dll
    .dll windows:4 windows x86 arch:x86

    0119d63f79e3f3aec8a3e2a3222688f9


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/modern-header.bmp
  • zen.win-specific\zen\update-settings.ini
  • zen.win-specific\zen\updater.exe
    .exe windows:10 windows x64 arch:x64

    edf02d7fd9dc80d8a245b3ea3133014b


    Code Sign

    Headers

    Imports

    Sections

  • zen.win-specific\zen\updater.ini
  • zen.win-specific\zen\vcruntime140.dll
    .dll windows:6 windows x64 arch:x64

    7f07fd94e5bb907093556781cc464017


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • zen.win-specific\zen\vcruntime140_1.dll
    .dll windows:6 windows x64 arch:x64

    72707e942878aac770fcc118ce3ec1c9


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • zen.win-specific\zen\xul.dll
    .dll windows:10 windows x64 arch:x64

    f1892ae268b2b098ecaaef925714e258


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • zen.win-specific\zen\zen.exe
    .exe windows:10 windows x64 arch:x64

    398e6fd5e822c4bef75599de404ed5f7


    Code Sign

    Headers

    Imports

    Exports

    Sections