MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 13505df434d68606d795543450bbbf96b02e5ae457386269fa47dd468cd32963. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


ZLoader


Vendor detections: 6


Intelligence 6 IOCs YARA 2 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 13505df434d68606d795543450bbbf96b02e5ae457386269fa47dd468cd32963
SHA3-384 hash: efc9812f62685ffd8be10312a8b2a0e4ec7a82cbd9d0e564ea444340759588588b54239036bec091d24ba23a6af430fd
SHA1 hash: 81d93a24390e91f6d0196b9177ceaaa21cbb2555
MD5 hash: 3b03932d4f4e77d890db09a3da309bad
humanhash: mexico-timing-fillet-diet
File name:3b03932d4f4e77d890db09a3da309bad.dll
Download: download sample
Signature ZLoader
Create hunting rule
File size:439'640 bytes
First seen:2020-10-07 04:29:55 UTC
Last seen:Never
File type:DLL dll
MIME type:application/x-dosexec
imphash 6a88e6a187ec120eacfe2e6648b79067 (5 x ZLoader)
ssdeep 6144:soPMXLGnQE9NphY64U/jMIuxF8RrnFnknZn3nRmn/nlnenvnxnGn5nPYnhnpanPv:ZPMbGnLphKeMIuxKR0Sn
Threatray 11 similar samples on MalwareBazaar
TLSH 10943E1ABCC04E9FD36A49B63DA51324169EED1D4751F10F87E4F662F0B0BF2AE90189
Reporter abuse_ch
Tags:dll ZLoader


Avatar
abuse_ch
ZLoader C2s:
fqnvtcpheas.su
fqnvtmqass.ru
fqnvsdaas.su
fqnesas.ru

Intelligence

File Origin
# of uploads :
1
# of downloads :
99
Origin country :
n/a
Vendor Threat Intelligence
Gathering data
Result
Verdict:
Clean
Maliciousness:

Behaviour
Sending a UDP request
Result
Threat name:
Unknown
Detection:
malicious
Classification:
evad
Score:
72 / 100
Link:
https://www.joesandbox.com/analysis/483530
Signature
Allocates memory in foreign processes
Contains functionality to inject code into remote processes
Creates autostart registry keys with suspicious values (likely registry only malware)
Multi AV Scanner detection for domain / URL
Multi AV Scanner detection for dropped file
Writes to foreign memory regions
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 294206 Sample: mfVMUXgksi.dll Startdate: 07/10/2020 Architecture: WINDOWS Score: 72 25 fqnvtmqass.ru 2->25 27 fqnvtcpheas.su 2->27 29 fqnvsdaas.su 2->29 37 Multi AV Scanner detection for domain / URL 2->37 39 Multi AV Scanner detection for dropped file 2->39 7 loaddll32.exe 1 2->7         started        10 regsvr32.exe 2->10         started        12 regsvr32.exe 2->12         started        signatures3 process4 signatures5 41 Contains functionality to inject code into remote processes 7->41 43 Writes to foreign memory regions 7->43 45 Allocates memory in foreign processes 7->45 14 msiexec.exe 3 25 7->14         started        19 regsvr32.exe 10->19         started        21 regsvr32.exe 12->21         started        process6 dnsIp7 31 fqnesas.ru 14->31 33 fqnvsdaas.su 14->33 23 C:\Users\user\AppData\Roaming\...\ytmuma.dll, PE32 14->23 dropped 35 Creates autostart registry keys with suspicious values (likely registry only malware) 14->35 file8 signatures9
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/13505df434d68606d795543450bbbf96b02e5ae457386269fa47dd468cd32963/
Threat name:
Win32.Trojan.ZLoader
Create hunting rule
Status:
Malicious
First seen:
2020-10-07 04:31:26 UTC
AV detection:
22 of 29 (75.86%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=cnif35bu22danv4vkq2fbo57s2yc4wxek44ge2p2i7oundgtffrq._file
Verdict:
malicious
Label(s):
zloader
Create hunting rule
Similar samples:
0c706ecdd8cb4393779872471c38ad5286f4883107e75835a91f007815e7413a
ZLoader
1aa9a36f8aef3a7e0d24920b0c5ba67e2b47b6d83a5db1df4570755776bbf08a
ZLoader
635643795ace3d11d9fcee724a6489deff5fd488005efe0ffe223b01c63109c6
ZLoader
6d6b1facdfff65b475a97c2a8fd297e8dc5fa597ecb5d6e225a524c53caeb44f
ZLoader
9fde971b9df0e8944242b3517e851447d1a2ab20e295d33c3355440bd24aad8a
ZLoader
b866a18458d22f3c362eb9db308ccbbe80ad1a1ef04d9f1c8ba6d3c66ccd4971
ZLoader
c842217385fa1a9462274e21cdcc9af2c0560e9c307090e708377d5c897d36cb
ZLoader
e5b375e6bd13f3bcc93e3f8687dca2ee2a77adeb8e445d2758a6db3259d3834c
ZLoader
eecaf5677c5c21d268261eef35a819549dda3c454e9b60e368070aa3bfd2f54c
ZLoader
fff929c4f44411e0f8da272f8d1db4593b23acd3c52cf8958792aef9548b4623
ZLoader
+ 1 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  1/10
Tags:
n/a
Link:
https://tria.ge/reports/201007-8apj3m3xgj/
Behaviour
Suspicious use of WriteProcessMemory
Unpacked files
SH256 hash:
13505df434d68606d795543450bbbf96b02e5ae457386269fa47dd468cd32963
MD5 hash:
3b03932d4f4e77d890db09a3da309bad
SHA1 hash:
81d93a24390e91f6d0196b9177ceaaa21cbb2555
Link:
https://www.unpac.me/results/3306a574-3da2-4adf-8ef8-8cbf04405caf/
SH256 hash:
41af0eba22c4bddc0395804a084c54d23a14075b14e730b11d87ef0aa3e7f2cd
MD5 hash:
3e33f6212beb1bac37357d830e8bb50c
SHA1 hash:
13fb110fb466ca8f270d99e1826b359290ba36a8
Detections:
win_zloader_auto
Create hunting rule
Link:
https://www.unpac.me/results/3306a574-3da2-4adf-8ef8-8cbf04405caf/
SH256 hash:
7c728a7835dceb478484c0a2a002696463a6bb6d02e4b8fe96ff7f61d526fe11
MD5 hash:
2734a8772e6c23d70c546af0c2e9a2e8
SHA1 hash:
adf223fa6d9c9325f4a743e8a679c74f818d631b
Link:
https://www.unpac.me/results/3306a574-3da2-4adf-8ef8-8cbf04405caf/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/13505df434d68606d795543450bbbf96b02e5ae457386269fa47dd468cd32963

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:win_zloader_auto
Create hunting rule
Author:Felix Bilstein - yara-signator at cocacoding dot com
Description:autogenerated rule brought to you by yara-signator
Rule name:with_sqlite
Create hunting rule
Author:Julian J. Gonzalez <info@seguridadparatodos.es>
Description:Rule to detect the presence of SQLite data in raw image
Reference:http://www.st2labs.com

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

ZLoader

DLL dll 13505df434d68606d795543450bbbf96b02e5ae457386269fa47dd468cd32963

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/661272/
  
Delivery method
Distributed via web download
Cape
Cape
https://www.capesandbox.com/analysis/68716/

Comments