MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 5694f91b4ded48c03a9a6d2be13f5d9300f873ee77ab4ac340facca786ef0f51. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

ZLoader

Vendor detections: 6

Intelligence 6 IOCs YARA 1 File information Comments

SHA256 hash:	5694f91b4ded48c03a9a6d2be13f5d9300f873ee77ab4ac340facca786ef0f51
SHA3-384 hash:	709c8ff2a53369880bb7c63f498d5eb5ff42f911482a21e8d18332c9d44677f8e2a9d469c5683ea7e6ea77b1c10f3a63
SHA1 hash:	0d8fb8f893f3c69d6e432c41ec59d8ee74cd5eaa
MD5 hash:	06f02760b4dcd1b8951b7df6e40ca11a
humanhash:	arizona-winner-december-undress
File name:	06f02760b4dcd1b8951b7df6e40ca11a.dll
Download:	download sample
Signature	ZLoader Create hunting rule
File size:	439'640 bytes
First seen:	2020-10-07 04:29:10 UTC
Last seen:	Never
File type:	dll
MIME type:	application/x-dosexec
imphash	6a88e6a187ec120eacfe2e6648b79067 (5 x ZLoader)
ssdeep	6144:NoPMXLGnQE9NphY64U/jMIuxF8RrnFnknZn3nRmn/nlnenvnxnGn5nPYnhnpanPs:mPMbGnLphKeMIuxKR0MOj
Threatray	14 similar samples on MalwareBazaar
TLSH	07943F1ABCC04E9FD35A49B63DA51324169EED1D4751F10F87E4F662F0B0BF2AEA0189
Reporter	abuse_ch
Tags:	dll ZLoader

Intelligence

File Origin

# of uploads :

# of downloads :

Origin country :

n/a

Vendor Threat Intelligence

Gathering data

Result

Verdict:

Clean

Maliciousness:

Result

Threat name:

Unknown

Detection:

malicious

Classification:

evad

Score:

64 / 100

Link:

https://www.joesandbox.com/analysis/483531

Signature

Allocates memory in foreign processes

Antivirus detection for URL or domain

Contains functionality to inject code into remote processes

Creates autostart registry keys with suspicious values (likely registry only malware)

Writes to foreign memory regions

Behaviour

Behavior Graph:

Download SVG

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/5694f91b4ded48c03a9a6d2be13f5d9300f873ee77ab4ac340facca786ef0f51/

Threat name:

Win32.Trojan.ZLoader

Status:

Malicious

First seen:

2020-10-07 04:31:05 UTC

AV detection:

24 of 29 (82.76%)

Threat level:

5/5

Detection(s):

Malicious file

Link:

https://check.spamhaus.org/check/?searchterm=k2kpsg2n5vemaou2nuv6cp25smapq47oo6vuvq2a7lgkpbxpb5iq._file

Verdict:

malicious

Label(s):

zloader

Result

Malware family:

n/a

Score:

1/10

Tags:

n/a

Link:

https://tria.ge/reports/201007-nk8th8jmpn/

Behaviour

Suspicious use of WriteProcessMemory

Unpacked files

SH256 hash:

5694f91b4ded48c03a9a6d2be13f5d9300f873ee77ab4ac340facca786ef0f51

MD5 hash:

06f02760b4dcd1b8951b7df6e40ca11a

SHA1 hash:

0d8fb8f893f3c69d6e432c41ec59d8ee74cd5eaa

Link:

https://www.unpac.me/results/f3cb5314-392e-4d0d-b080-e174388ec0b6/

SH256 hash:

f1d148dba2bf255deacc48ab0cf38161e4a818975275f98c03dd246ceb50c62c

MD5 hash:

39119b5c13cbe5b20b196c854a52ec83

SHA1 hash:

0ce4b733dad40395028f6293fdd0e55464f92819

Detections:

win_zloader_auto

Link:

https://www.unpac.me/results/f3cb5314-392e-4d0d-b080-e174388ec0b6/

SH256 hash:

ee68a431416a5f5a000b52f6b78b3f6ad4879cec83f9be3509bd461cfd3cf381

MD5 hash:

90d8f31da4a5c0be6331f3c7ff7a05fe

SHA1 hash:

78c066a800ceef077ad30eb4f8ebe3ad4b20e39b

Link:

https://www.unpac.me/results/f3cb5314-392e-4d0d-b080-e174388ec0b6/

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Legit

Score:

0.00

Link:

https://yomi.yoroi.company/submissions/5694f91b4ded48c03a9a6d2be13f5d9300f873ee77ab4ac340facca786ef0f51

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	win_zloader_auto Create hunting rule
Author:	Felix Bilstein - yara-signator at cocacoding dot com
Description:	autogenerated rule brought to you by yara-signator