MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 7f40442df67f60ef984b393c8001c600047a19a51780d1466373e95cd3ea44bf. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


ZLoader


Vendor detections: 7


Intelligence 7 IOCs YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 7f40442df67f60ef984b393c8001c600047a19a51780d1466373e95cd3ea44bf
SHA3-384 hash: 59bff81f97bf16c8554f63dd6fb1d12baaa6c0a42204ca7e44780892cf8707842c11a34029e6c1ce356254eeaf0d5bb0
SHA1 hash: c1e5917bb50e496f4bb501701a72943c355ad977
MD5 hash: b3f2e2a937e73fd7fafa2426ba6b7409
humanhash: friend-monkey-seven-island
File name:F8gU.dll
Download: download sample
Signature ZLoader
Create hunting rule
File size:553'984 bytes
First seen:2020-10-19 02:33:44 UTC
Last seen:2020-10-19 03:40:28 UTC
File type:DLL dll
MIME type:application/x-dosexec
imphash 817ad5c7d6d3cf2acc5ed41281974ec5 (2 x ZLoader)
ssdeep 12288:rGxtU0xHeIOnSwR1qN1jPOioYJFxPxq9GbXumsE7P1ZBfzNG7wYjjXkKjp:rGxtNx+IcHqnlcYZdZZ4j
Threatray 15 similar samples on MalwareBazaar
TLSH 25C48C20B982D076E06E0639CC21E5FC46697C598F755DE7B2E82F2F2D364D29B30E16
Reporter Secu0133
Tags:dll ZLoader

Intelligence

File Origin
# of uploads :
2
# of downloads :
107
Origin country :
n/a
Vendor Threat Intelligence
Detection:
Zloader
Create hunting rule
Link:
https://www.capesandbox.com/analysis/72702/
Detection(s):
SecuriteInfo.com.Variant.Mikey.116165.24886.24534.UNOFFICIAL
Create hunting rule

Result
Verdict:
Clean
Maliciousness:

Behaviour
Sending a UDP request
Creating a file in the %temp% directory
Delayed writing of the file
Delayed reading of the file
Result
Threat name:
Unknown
Detection:
suspicious
Classification:
n/a
Score:
26 / 100
Link:
https://www.joesandbox.com/analysis/494782
Signature
a
c
d
e
f
g
h
i
L
M
n
o
p
r
s
t
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 299842 Sample: F8gU.dll Startdate: 19/10/2020 Architecture: WINDOWS Score: 26 12 Machine Learning detection for sample 2->12 6 loaddll32.exe 1 2->6         started        process3 process4 8 rundll32.exe 6->8         started        10 rundll32.exe 1 6->10         started       
Detection:
zloader
Create hunting rule
Link:
https://mwdb.cert.pl/sample/7f40442df67f60ef984b393c8001c600047a19a51780d1466373e95cd3ea44bf/
Threat name:
Win32.Trojan.ZLoader
Create hunting rule
Status:
Malicious
First seen:
2020-10-19 02:35:06 UTC
AV detection:
22 of 29 (75.86%)
Threat level:
  5/5
Verdict:
unknown
Similar samples:
23be804db20cb450cf53fc82143ac34b9e741035c511af3e5c9880e7b3a70b3a
ZLoader
4b0c5b4530a9218d6030a7040a10ea5be84ffa3696601732ee7212691521474f
ZLoader
4df39fd80257e14192e2d2edc4500883edd7921e0be92d664ec4b995d8f82f24
ZLoader
530001e38045813d7276694c428b64b4dc5a15b77f2b3cc757f64b8d34bcf815
ZLoader
6571b88739b154807adbbe7b8d3ff75543887405f066489fb773a2186b862132
ZLoader
74c2d430eb964fbf5b3a1e37bb6f8770e571ef8998f71d945a479bba4a42d2cc
ZLoader
9f8ff8da154960d17a3225675a85372e7a70aca93df8bdfb887eb22c16b4dfe3
ZLoader
a95efda438fdee4b4866287c2cfe9d89772a46c5d9d22377c8c63e43b2c93295
ZLoader
b5399025d73dfb850df68017dfa81ce5f83bd9eeb7db056fffeca55ad3bcea65
ZLoader
c91847b9b00dddebd4f694412f2cc4c7346c15aa3cda2da856d9b0860a17ec50
ZLoader
+ 5 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  1/10
Tags:
n/a
Link:
https://tria.ge/reports/201019-j3p1kmpthe/
Behaviour
Suspicious use of WriteProcessMemory
Unpacked files
SH256 hash:
e69b577aec4d4652b11785727b67d26954fc8d33f0fca59cd354f52c3f9c59ed
MD5 hash:
a3e3d3ed92d56eba1a93968e3f7d19d4
SHA1 hash:
47868fa1e5ceda6ae708641ec097dd66bf18d684
Detections:
win_zloader_auto
Create hunting rule
Link:
https://www.unpac.me/results/3ac77294-f715-4458-9d71-553fb26354d9/
SH256 hash:
7f40442df67f60ef984b393c8001c600047a19a51780d1466373e95cd3ea44bf
MD5 hash:
b3f2e2a937e73fd7fafa2426ba6b7409
SHA1 hash:
c1e5917bb50e496f4bb501701a72943c355ad977
Link:
https://www.unpac.me/results/3ac77294-f715-4458-9d71-553fb26354d9/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/7f40442df67f60ef984b393c8001c600047a19a51780d1466373e95cd3ea44bf

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:win_zloader_auto
Create hunting rule
Author:Felix Bilstein - yara-signator at cocacoding dot com
Description:autogenerated rule brought to you by yara-signator

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/72702/

Comments