MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 0c706ecdd8cb4393779872471c38ad5286f4883107e75835a91f007815e7413a. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


ZLoader


Vendor detections: 7


Intelligence 7 IOCs YARA 2 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 0c706ecdd8cb4393779872471c38ad5286f4883107e75835a91f007815e7413a
SHA3-384 hash: f1f4058ca7440eb4f057a629bd13e8f49939cf7e0aacb6760556b46854410aad49609155ee7972efc8c9e54f7fe152da
SHA1 hash: e119cfa624d2373d0c35930e0c682100b0d092b4
MD5 hash: 5cf26b8152b725eef68a7c7c4a0ce1a9
humanhash: burger-alabama-fish-five
File name:SecuriteInfo.com.BScope.Trojan.Diple.23366
Download: download sample
Signature ZLoader
Create hunting rule
File size:439'640 bytes
First seen:2020-10-06 21:36:01 UTC
Last seen:Never
File type:DLL dll
MIME type:application/x-dosexec
imphash 6a88e6a187ec120eacfe2e6648b79067 (5 x ZLoader)
ssdeep 6144:uoPMXLGnQE9NphY64U/jMIuxF8RrnFnknZn3nRmn/nlnenvnxnGn5nPYnhnpanPO:LPMbGnLphKeMIuxKR0IQ
Threatray 6 similar samples on MalwareBazaar
TLSH 10943E1ABCC04E9FD36A49B63DA51324169EED1D4751F10F87E4F662F0B0BF2AE90189
Reporter SecuriteInfoCom
Tags:ZLoader

Intelligence

File Origin
# of uploads :
1
# of downloads :
117
Origin country :
n/a
Vendor Threat Intelligence
Gathering data
Result
Verdict:
Clean
Maliciousness:

Behaviour
Sending a UDP request
Result
Threat name:
Unknown
Detection:
malicious
Classification:
evad
Score:
80 / 100
Link:
https://www.joesandbox.com/analysis/483408
Signature
Allocates memory in foreign processes
Antivirus detection for URL or domain
Contains functionality to inject code into remote processes
Creates autostart registry keys with suspicious values (likely registry only malware)
Multi AV Scanner detection for domain / URL
Multi AV Scanner detection for submitted file
Writes to foreign memory regions
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 294144 Sample: SecuriteInfo.com.BScope.Tro... Startdate: 06/10/2020 Architecture: WINDOWS Score: 80 25 fqnvtmqass.ru 2->25 27 fqnvtcpheas.su 2->27 37 Multi AV Scanner detection for domain / URL 2->37 39 Antivirus detection for URL or domain 2->39 41 Multi AV Scanner detection for submitted file 2->41 7 loaddll32.exe 1 2->7         started        10 regsvr32.exe 2->10         started        12 regsvr32.exe 2->12         started        signatures3 process4 signatures5 43 Contains functionality to inject code into remote processes 7->43 45 Writes to foreign memory regions 7->45 47 Allocates memory in foreign processes 7->47 14 msiexec.exe 3 25 7->14         started        19 regsvr32.exe 10->19         started        21 regsvr32.exe 12->21         started        process6 dnsIp7 29 fqnvtmqass.ru 14->29 31 fqnvsdaas.su 14->31 33 fqnesas.ru 14->33 23 C:\Users\user\AppData\Roaming\...\uxuxso.dll, PE32 14->23 dropped 35 Creates autostart registry keys with suspicious values (likely registry only malware) 14->35 file8 signatures9
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/0c706ecdd8cb4393779872471c38ad5286f4883107e75835a91f007815e7413a/
Threat name:
Win32.Trojan.ZLoader
Create hunting rule
Status:
Malicious
First seen:
2020-10-06 21:37:06 UTC
AV detection:
22 of 29 (75.86%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=bryg5toyznbzg54yojdryofnkkdpjcbra7tvqnnjd4ahqfphie5a._file
Verdict:
malicious
Label(s):
zloader
Create hunting rule
Similar samples:
3712c1a9e9ab864ee28897d0802179db4a2f664f61629f1154437640be377530
ZLoader
635643795ace3d11d9fcee724a6489deff5fd488005efe0ffe223b01c63109c6
ZLoader
6d6b1facdfff65b475a97c2a8fd297e8dc5fa597ecb5d6e225a524c53caeb44f
ZLoader
b866a18458d22f3c362eb9db308ccbbe80ad1a1ef04d9f1c8ba6d3c66ccd4971
ZLoader
eecaf5677c5c21d268261eef35a819549dda3c454e9b60e368070aa3bfd2f54c
ZLoader
fff929c4f44411e0f8da272f8d1db4593b23acd3c52cf8958792aef9548b4623
ZLoader
Result
Malware family:
n/a
Score:
  1/10
Tags:
n/a
Link:
https://tria.ge/reports/201006-9bvrentq5x/
Behaviour
Suspicious use of WriteProcessMemory
Unpacked files
SH256 hash:
0c706ecdd8cb4393779872471c38ad5286f4883107e75835a91f007815e7413a
MD5 hash:
5cf26b8152b725eef68a7c7c4a0ce1a9
SHA1 hash:
e119cfa624d2373d0c35930e0c682100b0d092b4
Link:
https://www.unpac.me/results/0201d70d-7cd8-40bc-8337-196e154ea664/
SH256 hash:
4bde03d8efd8e0214d8a14ac98e147aafb53b82f25c4518be70f6917b83ec6dd
MD5 hash:
c2bf42de6dd46188ee70c763b4a0df92
SHA1 hash:
22694fdfee751e6a6d3c77620ea84ba2ae36f13f
Link:
https://www.unpac.me/results/0201d70d-7cd8-40bc-8337-196e154ea664/
SH256 hash:
fe59e6dfb8e35f06b1ce0f43a2361dc351c8695ba0e83671647c48ec69c9ec91
MD5 hash:
2fc15c4fa03a05130b0be575df5977b9
SHA1 hash:
67cb613b2bf5d0ff152b78590552693017355638
Detections:
win_zloader_auto
Create hunting rule
Link:
https://www.unpac.me/results/0201d70d-7cd8-40bc-8337-196e154ea664/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Kryptik
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/0c706ecdd8cb4393779872471c38ad5286f4883107e75835a91f007815e7413a

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:win_zloader_auto
Create hunting rule
Author:Felix Bilstein - yara-signator at cocacoding dot com
Description:autogenerated rule brought to you by yara-signator
Rule name:with_sqlite
Create hunting rule
Author:Julian J. Gonzalez <info@seguridadparatodos.es>
Description:Rule to detect the presence of SQLite data in raw image
Reference:http://www.st2labs.com

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

ZLoader

DLL dll 0c706ecdd8cb4393779872471c38ad5286f4883107e75835a91f007815e7413a

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/661272/
  
Delivery method
Distributed via web download
Cape
Cape
https://www.capesandbox.com/analysis/68691/

Comments