🤲🏼 NEW | abuse.ch Community Hub! Earn recognition 🏅 for the malware intelligence you share, climb the leaderboards 📈, and connect with like-minded contributors who share your hunting focus 🤝. Ready to unlock your profile? Go to the Community Hub →

MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 2922201eaae7c9a32ad5b1bfb4cd275e2acfb96771ca7a98463aa6a46ca0144b. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


ZLoader


Vendor detections: 8


Intelligence 8 IOCs YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 2922201eaae7c9a32ad5b1bfb4cd275e2acfb96771ca7a98463aa6a46ca0144b
SHA3-384 hash: 91d288bdde01234a24f52e782888c80f0b42d9116a409c3e796f3cb7a95992d582d0eb9e74ffbcd9aabf090747f00523
SHA1 hash: ccb49453d556fadaa8f48d0845c7239f3e63a81d
MD5 hash: b3bdf9cf86b1ddb2b11c1d2f343cd80f
humanhash: batman-washington-illinois-victor
File name:SAPDOFGGMAD.exe
Download: download sample
Signature ZLoader
Create hunting rule
File size:359'938 bytes
First seen:2020-10-05 19:25:59 UTC
Last seen:2020-10-06 14:27:27 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash 7f68de3a33fb55e2886d92b6a0f15900 (1 x ZLoader)
ssdeep 6144:SM6VKUOaXFYveA5ArdQylz5Ylp0/l92qgK7LQqv4KSw2nFk3Yls8oQTnSucE3bvw:0VVbeh5Ar68+lp0OO7L5vaLFWYS8oQTo
TLSH 4574E1513AC1C031F6B208399460CFB58B6DBD204BA4E9DB77C018AF5E725D19636BBB
Reporter James_inthe_box
Tags:exe ZLoader

Intelligence

File Origin
# of uploads :
3
# of downloads :
137
Origin country :
n/a
Vendor Threat Intelligence
Detection:
Zloader
Create hunting rule
Link:
https://www.capesandbox.com/analysis/68314/
Result
Verdict:
Clean
Maliciousness:

Behaviour
Sending a UDP request
Creating a file in the %temp% directory
Deleting a recently created file
Replacing files
Delayed writing of the file
Delayed reading of the file
Result
Threat name:
Unknown
Detection:
malicious
Classification:
evad
Score:
68 / 100
Link:
https://www.joesandbox.com/analysis/481960
Signature
Detected unpacking (changes PE section rights)
Detected unpacking (overwrites its own PE header)
Machine Learning detection for sample
Multi AV Scanner detection for submitted file
Behaviour
Behavior Graph:
Download SVG
Detection:
zloader
Create hunting rule
Link:
https://mwdb.cert.pl/sample/2922201eaae7c9a32ad5b1bfb4cd275e2acfb96771ca7a98463aa6a46ca0144b/
Threat name:
Win32.Trojan.Ymacco
Create hunting rule
Status:
Malicious
First seen:
2020-10-05 19:25:45 UTC
File Type:
PE (Exe)
Extracted files:
2
AV detection:
23 of 29 (79.31%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=fercahvk47e2gkwvwg73jtjhlyvm7olhohfhvgcghktki3facrfq._file
Result
Malware family:
n/a
Score:
  1/10
Tags:
n/a
Link:
https://tria.ge/reports/201005-r4e8hnllna/
Unpacked files
SH256 hash:
2922201eaae7c9a32ad5b1bfb4cd275e2acfb96771ca7a98463aa6a46ca0144b
MD5 hash:
b3bdf9cf86b1ddb2b11c1d2f343cd80f
SHA1 hash:
ccb49453d556fadaa8f48d0845c7239f3e63a81d
Link:
https://www.unpac.me/results/2cae5860-b42c-4dcf-ac6b-019b38756b04/
SH256 hash:
01703c5a35e1203698c03af067e69dc19370f95966ca94c2b16244abacb2f5fa
MD5 hash:
2d15627bc91039b080041fdb0eecd8d5
SHA1 hash:
74b5ba853d386440be8a19e776136038d72c700a
Detections:
win_zloader_a0
Create hunting rule
win_zloader_auto
Create hunting rule
Link:
https://www.unpac.me/results/2cae5860-b42c-4dcf-ac6b-019b38756b04/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Trojan
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/2922201eaae7c9a32ad5b1bfb4cd275e2acfb96771ca7a98463aa6a46ca0144b

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:win_zloader_auto
Create hunting rule
Author:Felix Bilstein - yara-signator at cocacoding dot com
Description:autogenerated rule brought to you by yara-signator

File information

The table below shows additional information about this malware sample such as delivery method and external references.

  
Delivery method
Other
Cape
Cape
https://www.capesandbox.com/analysis/68314/

Comments