MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 782ea4a6943ceafa3d1133c5cbba0bbb6cdd88953ffae7ab89ac8a7f79101e0a. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

ZLoader

Vendor detections: 6

Intelligence 6 IOCs YARA 1 File information Comments

SHA256 hash:	782ea4a6943ceafa3d1133c5cbba0bbb6cdd88953ffae7ab89ac8a7f79101e0a
SHA3-384 hash:	bb817839339aff370e0f9dfffc6211c3baa36cac783913089c03e669872b124e39c515743eb33328c7825302be8ef00d
SHA1 hash:	96ea3fe6d96c3ecd6a66814c221e51f64d9c55a1
MD5 hash:	02ac15cd01137d4ead20c840f004d3ef
humanhash:	vermont-bulldog-charlie-pasta
File name:	02ac15cd01137d4ead20c840f004d3ef.dll
Download:	download sample
Signature	ZLoader Create hunting rule
File size:	439'640 bytes
First seen:	2020-10-07 04:32:02 UTC
Last seen:	Never
File type:	dll
MIME type:	application/x-dosexec
imphash	4fd12319308b8413e33cf68fb63d30b5 (9 x ZLoader)
ssdeep	6144:AUoPMXLGnQE9NphY64U/jMIuxF8RrnFnknZn3nRmn/nlnenvnxnGn5nPYnhnpan/:MPMbGnLphKeMIuxKR5
Threatray	18 similar samples on MalwareBazaar
TLSH	6F943E1ABCC04E9FD76A49B63DA41324169EED1D4751F10F87E4F662F0B0BF2AE90189
Reporter	abuse_ch
Tags:	dll ZLoader

abuse_ch

ZLoader C2s:
fqnvtcpheas.su
fqnvtmqass.ru
fqnvsdaas.su
fqnesas.ru

Intelligence

File Origin

# of uploads :

# of downloads :

Origin country :

n/a

Vendor Threat Intelligence

Gathering data

Result

Verdict:

Clean

Maliciousness:

Behaviour

Sending a UDP request

Result

Threat name:

Unknown

Detection:

malicious

Classification:

evad

Score:

72 / 100

Link:

https://www.joesandbox.com/analysis/483544

Signature

Allocates memory in foreign processes

Contains functionality to inject code into remote processes

Creates autostart registry keys with suspicious values (likely registry only malware)

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Writes to foreign memory regions

Behaviour

Behavior Graph:

Download SVG

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/782ea4a6943ceafa3d1133c5cbba0bbb6cdd88953ffae7ab89ac8a7f79101e0a/

Threat name:

Win32.Trojan.ZLoader

Status:

Malicious

First seen:

2020-10-07 04:33:11 UTC

AV detection:

21 of 29 (72.41%)

Threat level:

5/5

Detection(s):

Malicious file

Link:

https://check.spamhaus.org/check/?searchterm=paxkjjuuhtvpupirgpc4xoqlxnwn3cevh75opk4jvsfh66iqdyfa._file

Verdict:

malicious

Label(s):

zloader

Result

Malware family:

n/a

Score:

1/10

Tags:

n/a

Link:

https://tria.ge/reports/201007-dc4w53yzd6/

Behaviour

Suspicious use of WriteProcessMemory

Unpacked files

SH256 hash:

782ea4a6943ceafa3d1133c5cbba0bbb6cdd88953ffae7ab89ac8a7f79101e0a

MD5 hash:

02ac15cd01137d4ead20c840f004d3ef

SHA1 hash:

96ea3fe6d96c3ecd6a66814c221e51f64d9c55a1

Link:

https://www.unpac.me/results/2a41e6ec-0754-4683-9652-ced965023459/

SH256 hash:

e3d0cdaca02aa4db2fc12a052460f9cc6d5af4fa3859525ddcf93a4397709a6a

MD5 hash:

1e26f955fccfd6b101ef18619571210d

SHA1 hash:

838b677ae4f81625e371379479d8bfc291aa7d5b

Link:

https://www.unpac.me/results/2a41e6ec-0754-4683-9652-ced965023459/

SH256 hash:

21f2e5ab99ea14d48dde3a164b122d2cea94a9733566d53885ee41a1c80cccf6

MD5 hash:

9327b5df60f4031f0de61e78aeb431bd

SHA1 hash:

5494ae8f69834094cfd42e28ec74616665a72e3d

Detections:

win_zloader_auto

Link:

https://www.unpac.me/results/2a41e6ec-0754-4683-9652-ced965023459/

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Legit

Score:

0.00

Link:

https://yomi.yoroi.company/submissions/782ea4a6943ceafa3d1133c5cbba0bbb6cdd88953ffae7ab89ac8a7f79101e0a

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	win_zloader_auto Create hunting rule
Author:	Felix Bilstein - yara-signator at cocacoding dot com
Description:	autogenerated rule brought to you by yara-signator