MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 191bbf8eafbe5dfcf56bb139f36d44724bdb9fd1e708cd29dfd2d7b2b916f9f2. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

ZLoader

Vendor detections: 6

Intelligence 6 IOCs YARA 1 File information Comments

SHA256 hash:	191bbf8eafbe5dfcf56bb139f36d44724bdb9fd1e708cd29dfd2d7b2b916f9f2
SHA3-384 hash:	63314dc0a3f3f4198add8e991366bba520efa69cd96c52e2a3ec0842c17976f1a4a18644519bcd6b1ac5e08b85cfcfc9
SHA1 hash:	451dd7d059eb7fd22bb7bb46e64de0a1436e6dc3
MD5 hash:	adfde0367ba639980632da58a5444005
humanhash:	march-sad-stream-social
File name:	adfde0367ba639980632da58a5444005.dll
Download:	download sample
Signature	ZLoader Create hunting rule
File size:	439'640 bytes
First seen:	2020-10-07 04:32:18 UTC
Last seen:	Never
File type:	dll
MIME type:	application/x-dosexec
imphash	4fd12319308b8413e33cf68fb63d30b5 (9 x ZLoader)
ssdeep	6144:os3ToPMXLGnQE9NphY64U/jMIuxF8RrnFnknZn3nRmn/nlnenvnxnGn5nPYnhnpL:n3EPMbGnLphKeMIuxKRgb
Threatray	16 similar samples on MalwareBazaar
TLSH	8B943E1ABCC04E9FD76A49B63DA41324169EED1D4751F10F87E4F662F0B0BF2AE90189
Reporter	abuse_ch
Tags:	dll ZLoader

abuse_ch

ZLoader C2s:
fqnvtcpheas.su
fqnvtmqass.ru
fqnvsdaas.su
fqnesas.ru

Intelligence

File Origin

# of uploads :

# of downloads :

Origin country :

n/a

Vendor Threat Intelligence

Gathering data

Result

Verdict:

Clean

Maliciousness:

Behaviour

Sending a UDP request

Result

Threat name:

Unknown

Detection:

malicious

Classification:

evad

Score:

72 / 100

Link:

https://www.joesandbox.com/analysis/483542

Signature

Allocates memory in foreign processes

Contains functionality to inject code into remote processes

Creates autostart registry keys with suspicious values (likely registry only malware)

Multi AV Scanner detection for domain / URL

Multi AV Scanner detection for dropped file

Writes to foreign memory regions

Behaviour

Behavior Graph:

Download SVG

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/191bbf8eafbe5dfcf56bb139f36d44724bdb9fd1e708cd29dfd2d7b2b916f9f2/

Threat name:

Win32.Trojan.ZLoader

Status:

Malicious

First seen:

2020-10-07 04:34:08 UTC

AV detection:

21 of 29 (72.41%)

Threat level:

5/5

Detection(s):

Malicious file

Link:

https://check.spamhaus.org/check/?searchterm=den37dvpxzo7z5llwe47g3keojf5xh6r44em2ko72ll3foiw7hza._file

Verdict:

malicious

Label(s):

zloader

Result

Malware family:

n/a

Score:

1/10

Tags:

n/a

Link:

https://tria.ge/reports/201007-bq47zyvhf2/

Behaviour

Suspicious use of WriteProcessMemory

Unpacked files

SH256 hash:

191bbf8eafbe5dfcf56bb139f36d44724bdb9fd1e708cd29dfd2d7b2b916f9f2

MD5 hash:

adfde0367ba639980632da58a5444005

SHA1 hash:

451dd7d059eb7fd22bb7bb46e64de0a1436e6dc3

Link:

https://www.unpac.me/results/1a5bbe03-8a99-40fd-ad77-2f07aaec6c4e/

SH256 hash:

a6ace3a35605b49790faf35617125b7c88a3c1dbbb4b77f86c680f3aeb5d074a

MD5 hash:

b305b6fdd01dbf8878772b8f63a70fe6

SHA1 hash:

dd53c0163c7ca5c7b7631328e8668de4d91ffc21

Link:

https://www.unpac.me/results/1a5bbe03-8a99-40fd-ad77-2f07aaec6c4e/

SH256 hash:

ac2a53dfc424e6a1b821f0bacc75c89a68a1876e2b04f7ada5b6282987cd3834

MD5 hash:

20c6110f92206919f828eee5109aeafd

SHA1 hash:

4fc11a60fa650fb05197e131269ad591b2ac13c5

Detections:

win_zloader_auto

Link:

https://www.unpac.me/results/1a5bbe03-8a99-40fd-ad77-2f07aaec6c4e/

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Legit

Score:

0.00

Link:

https://yomi.yoroi.company/submissions/191bbf8eafbe5dfcf56bb139f36d44724bdb9fd1e708cd29dfd2d7b2b916f9f2

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	win_zloader_auto Create hunting rule
Author:	Felix Bilstein - yara-signator at cocacoding dot com
Description:	autogenerated rule brought to you by yara-signator