MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 43793213377997037322e05eb5522a0509d45d55dbe634b957b66eea18f55aee. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

ZLoader

Vendor detections: 6

Intelligence 6 IOCs YARA 2 File information Comments

SHA256 hash:	43793213377997037322e05eb5522a0509d45d55dbe634b957b66eea18f55aee
SHA3-384 hash:	d215dcf6101db0dbaa0c05b453801214e5a2e87bdc4c273237ae4ec11e6597eb8fa91a8e79c6620525b2b8217af1ae30
SHA1 hash:	88436f6203461bb32118c20d7be9298a57a4e291
MD5 hash:	5d209e2ede7ee206ea0daaa4e7559f61
humanhash:	september-coffee-ink-eighteen
File name:	5d209e2ede7ee206ea0daaa4e7559f61.dll
Download:	download sample
Signature	ZLoader Create hunting rule
File size:	439'640 bytes
First seen:	2020-10-07 04:31:52 UTC
Last seen:	Never
File type:	dll
MIME type:	application/x-dosexec
imphash	4fd12319308b8413e33cf68fb63d30b5 (9 x ZLoader)
ssdeep	6144:xs3ToPMXLGnQE9NphY64U/jMIuxF8RrnFnknZn3nRmn/nlnenvnxnGn5nPYnhnpi:q3EPMbGnLphKeMIuxKRrd
Threatray	15 similar samples on MalwareBazaar
TLSH	20943E1ABCC04E9FD76A49B63DA41324169EED1D4751F10F87E4F662F0B0BF2AE90189
Reporter	abuse_ch
Tags:	dll ZLoader

abuse_ch

ZLoader C2s:
fqnvtcpheas.su
fqnvtmqass.ru
fqnvsdaas.su
fqnesas.ru

Intelligence

File Origin

# of uploads :

# of downloads :

Origin country :

n/a

Vendor Threat Intelligence

Gathering data

Result

Verdict:

Clean

Maliciousness:

Behaviour

Sending a UDP request

Result

Threat name:

Unknown

Detection:

malicious

Classification:

evad

Score:

56 / 100

Link:

https://www.joesandbox.com/analysis/483543

Signature

Allocates memory in foreign processes

Contains functionality to inject code into remote processes

Creates autostart registry keys with suspicious values (likely registry only malware)

Writes to foreign memory regions

Behaviour

Behavior Graph:

Download SVG

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/43793213377997037322e05eb5522a0509d45d55dbe634b957b66eea18f55aee/

Threat name:

Win32.Trojan.ZLoader

Status:

Malicious

First seen:

2020-10-07 04:33:09 UTC

AV detection:

21 of 29 (72.41%)

Threat level:

5/5

Detection(s):

Malicious file

Link:

https://check.spamhaus.org/check/?searchterm=in4teezxpglqg4zc4bplkurkaue5ixkv3ptdjokxwzxoughvllxa._file

Verdict:

malicious

Label(s):

zloader

Result

Malware family:

n/a

Score:

1/10

Tags:

n/a

Link:

https://tria.ge/reports/201007-tz6e1kjntj/

Behaviour

Suspicious use of WriteProcessMemory

Unpacked files

SH256 hash:

43793213377997037322e05eb5522a0509d45d55dbe634b957b66eea18f55aee

MD5 hash:

5d209e2ede7ee206ea0daaa4e7559f61

SHA1 hash:

88436f6203461bb32118c20d7be9298a57a4e291

Link:

https://www.unpac.me/results/ca19962f-cd4c-4fa9-83a2-d3df3c25b243/

SH256 hash:

b2ac5f9d67d6f814381c81597f2e01d76ded711c227054d2b6d40a8416751853

MD5 hash:

10fb31225521d238143d570f5eedcf9b

SHA1 hash:

11c47a023151e1a28fb7388b27f445d13836428f

Detections:

win_zloader_auto

Link:

https://www.unpac.me/results/ca19962f-cd4c-4fa9-83a2-d3df3c25b243/

SH256 hash:

be3ddba4aa8b47f75bd31def5722de2bda0b33db57f0614eccda6784e680d496

MD5 hash:

908722c4f31ca340dc427b2803225a92

SHA1 hash:

74a2f19d6ae7987495499c2ff5818811237f8c0d

Link:

https://www.unpac.me/results/ca19962f-cd4c-4fa9-83a2-d3df3c25b243/

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Legit

Score:

0.00

Link:

https://yomi.yoroi.company/submissions/43793213377997037322e05eb5522a0509d45d55dbe634b957b66eea18f55aee

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	win_zloader_auto Create hunting rule
Author:	Felix Bilstein - yara-signator at cocacoding dot com
Description:	autogenerated rule brought to you by yara-signator

Rule name:	with_sqlite Create hunting rule
Author:	Julian J. Gonzalez <info@seguridadparatodos.es>
Description:	Rule to detect the presence of SQLite data in raw image
Reference:	http://www.st2labs.com