MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 1aa9a36f8aef3a7e0d24920b0c5ba67e2b47b6d83a5db1df4570755776bbf08a. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


ZLoader


Vendor detections: 8


Intelligence 8 IOCs YARA 2 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 1aa9a36f8aef3a7e0d24920b0c5ba67e2b47b6d83a5db1df4570755776bbf08a
SHA3-384 hash: c5905a9fb71f8ae55ce7e5f126357bb5a9b8ec84def60283f6c9fc488d47adec78b61981524c202758d1e12dae33bf17
SHA1 hash: d45edbe2e5547b6b610729993f2ba399702a93ee
MD5 hash: 60a9b1cd9ea9274cca3fb9aa0ab76901
humanhash: hot-enemy-asparagus-nuts
File name:60a9b1cd9ea9274cca3fb9aa0ab76901.dll
Download: download sample
Signature ZLoader
Create hunting rule
File size:439'640 bytes
First seen:2020-10-07 04:27:52 UTC
Last seen:Never
File type:DLL dll
MIME type:application/x-dosexec
imphash 4fd12319308b8413e33cf68fb63d30b5 (9 x ZLoader)
ssdeep 6144:Cs3ToPMXLGnQE9NphY64U/jMIuxF8RrnFnknZn3nRmn/nlnenvnxnGn5nPYnhnpL:N3EPMbGnLphKeMIuxKRcr
Threatray 8 similar samples on MalwareBazaar
TLSH 01943E1ABCC04E9FD76A49B63DA41324169EED1D4751F10F87E4F662F0B0BF2AE90189
Reporter abuse_ch
Tags:dll ZLoader


Avatar
abuse_ch
ZLoader C2s:
fqnvtcpheas.su
fqnesas.ru
fqnvsdaas.su
fqnvtmqass.ru

Intelligence

File Origin
# of uploads :
1
# of downloads :
96
Origin country :
n/a
Vendor Threat Intelligence
Detection:
Zloader
Create hunting rule
Link:
https://www.capesandbox.com/analysis/68708/
Result
Verdict:
Clean
Maliciousness:

Behaviour
Sending a UDP request
Result
Threat name:
Unknown
Detection:
malicious
Classification:
evad
Score:
60 / 100
Link:
https://www.joesandbox.com/analysis/483520
Signature
Allocates memory in foreign processes
Contains functionality to inject code into remote processes
Creates autostart registry keys with suspicious values (likely registry only malware)
Sigma detected: Suspicious Svchost Process
Writes to foreign memory regions
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 294202 Sample: miWXOPqTEm.dll Startdate: 07/10/2020 Architecture: WINDOWS Score: 60 27 fqnvtmqass.ru 2->27 29 fqnvtcpheas.su 2->29 39 Sigma detected: Suspicious Svchost Process 2->39 7 loaddll32.exe 1 2->7         started        10 regsvr32.exe 2->10         started        12 regsvr32.exe 2->12         started        signatures3 process4 signatures5 41 Contains functionality to inject code into remote processes 7->41 43 Writes to foreign memory regions 7->43 45 Allocates memory in foreign processes 7->45 14 msiexec.exe 3 25 7->14         started        19 svchost.exe 1 7->19         started        21 regsvr32.exe 10->21         started        23 regsvr32.exe 12->23         started        process6 dnsIp7 31 fqnvtmqass.ru 14->31 33 fqnvsdaas.su 14->33 35 fqnesas.ru 14->35 25 C:\Users\user\AppData\Roaming\...\licai.dll, PE32 14->25 dropped 37 Creates autostart registry keys with suspicious values (likely registry only malware) 14->37 file8 signatures9
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/1aa9a36f8aef3a7e0d24920b0c5ba67e2b47b6d83a5db1df4570755776bbf08a/
Threat name:
Win32.Trojan.ZLoader
Create hunting rule
Status:
Malicious
First seen:
2020-10-07 04:29:04 UTC
AV detection:
22 of 29 (75.86%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=dku2g34k545h4djesifqyw5gpyvupnwyhjo3dx2fob2vo5v36cfa._file
Verdict:
malicious
Label(s):
zloader
Create hunting rule
Similar samples:
0c706ecdd8cb4393779872471c38ad5286f4883107e75835a91f007815e7413a
ZLoader
3712c1a9e9ab864ee28897d0802179db4a2f664f61629f1154437640be377530
ZLoader
4faa13a20e77f72c5bfc411b914a57a832f22495f90ddfd2aca91908d22a7c94
ZLoader
635643795ace3d11d9fcee724a6489deff5fd488005efe0ffe223b01c63109c6
ZLoader
6d6b1facdfff65b475a97c2a8fd297e8dc5fa597ecb5d6e225a524c53caeb44f
ZLoader
b866a18458d22f3c362eb9db308ccbbe80ad1a1ef04d9f1c8ba6d3c66ccd4971
ZLoader
eecaf5677c5c21d268261eef35a819549dda3c454e9b60e368070aa3bfd2f54c
ZLoader
fff929c4f44411e0f8da272f8d1db4593b23acd3c52cf8958792aef9548b4623
ZLoader
Result
Malware family:
n/a
Score:
  1/10
Tags:
n/a
Link:
https://tria.ge/reports/201007-mjx2h48l7e/
Behaviour
Suspicious use of WriteProcessMemory
Unpacked files
SH256 hash:
1aa9a36f8aef3a7e0d24920b0c5ba67e2b47b6d83a5db1df4570755776bbf08a
MD5 hash:
60a9b1cd9ea9274cca3fb9aa0ab76901
SHA1 hash:
d45edbe2e5547b6b610729993f2ba399702a93ee
Link:
https://www.unpac.me/results/76e705f0-bbe5-4c32-a0b3-8f107441157e/
SH256 hash:
3a88356f495ff1dc111671ea612cb8d73c7100242e4e5115cb15c490f22652cf
MD5 hash:
caecf7fcd5778fde6f0b11d2baac5615
SHA1 hash:
f06c49d06b706c5c768a20dd94af9fbb64e1f35e
Link:
https://www.unpac.me/results/76e705f0-bbe5-4c32-a0b3-8f107441157e/
SH256 hash:
516d538026837ec2cc4bb2ee469d5f4c76f16a2e24750256cb3100c15d348edc
MD5 hash:
a70db3ed61f7446273bab87b75c988d3
SHA1 hash:
717c79dc1d44c575a27008aea56aa68a54d28e61
Detections:
win_zloader_auto
Create hunting rule
Link:
https://www.unpac.me/results/76e705f0-bbe5-4c32-a0b3-8f107441157e/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
ZLoader
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/1aa9a36f8aef3a7e0d24920b0c5ba67e2b47b6d83a5db1df4570755776bbf08a

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:win_zloader_auto
Create hunting rule
Author:Felix Bilstein - yara-signator at cocacoding dot com
Description:autogenerated rule brought to you by yara-signator
Rule name:with_sqlite
Create hunting rule
Author:Julian J. Gonzalez <info@seguridadparatodos.es>
Description:Rule to detect the presence of SQLite data in raw image
Reference:http://www.st2labs.com

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

ZLoader

DLL dll 1aa9a36f8aef3a7e0d24920b0c5ba67e2b47b6d83a5db1df4570755776bbf08a

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/661272/
  
Delivery method
Distributed via web download
Cape
Cape
https://www.capesandbox.com/analysis/68708/

Comments