MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 89fe58276e356b9cfff31829f346c90363f20dd9d981da2491db0b7c67f77e86. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

ZLoader

Vendor detections: 6

Intelligence 6 IOCs YARA 1 File information Comments

SHA256 hash:	89fe58276e356b9cfff31829f346c90363f20dd9d981da2491db0b7c67f77e86
SHA3-384 hash:	eb649f4a934f5b4ce00e6dfac5e1750c41aaeec6a376f57f2055707b3b52a93b8db7a0ca3c10cc1a1f064ef6c1940648
SHA1 hash:	9f8a7bb9869ceeb5bd18f78b480f125b547bc7a2
MD5 hash:	425e8b1aa7e97b261d5876257bed8698
humanhash:	one-fanta-twenty-golf
File name:	425e8b1aa7e97b261d5876257bed8698.dll
Download:	download sample
Signature	ZLoader Create hunting rule
File size:	439'640 bytes
First seen:	2020-10-07 04:31:46 UTC
Last seen:	Never
File type:	dll
MIME type:	application/x-dosexec
imphash	6a88e6a187ec120eacfe2e6648b79067 (5 x ZLoader)
ssdeep	6144:ToPMXLGnQE9NphY64U/jMIuxF8RrnFnknZn3nRmn/nlnenvnxnGn5nPYnhnpanPO:EPMbGnLphKeMIuxKR0nf
Threatray	15 similar samples on MalwareBazaar
TLSH	19943E1ABCC04E9FD35A49B63DA51324169EED1D4791F10F87E4F662F0B0BF2AE90189
Reporter	abuse_ch
Tags:	dll ZLoader

abuse_ch

ZLoader C2s:
fqnvtcpheas.su
fqnvtmqass.ru
fqnvsdaas.su
fqnesas.ru

Intelligence

File Origin

# of uploads :

# of downloads :

Origin country :

n/a

Vendor Threat Intelligence

Gathering data

Result

Verdict:

Clean

Maliciousness:

Behaviour

Sending a UDP request

Result

Threat name:

Unknown

Detection:

malicious

Classification:

evad

Score:

72 / 100

Link:

https://www.joesandbox.com/analysis/483549

Signature

Allocates memory in foreign processes

Antivirus detection for URL or domain

Contains functionality to inject code into remote processes

Creates autostart registry keys with suspicious values (likely registry only malware)

Multi AV Scanner detection for dropped file

Writes to foreign memory regions

Behaviour

Behavior Graph:

Download SVG

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/89fe58276e356b9cfff31829f346c90363f20dd9d981da2491db0b7c67f77e86/

Threat name:

Win32.Trojan.ZLoader

Status:

Malicious

First seen:

2020-10-07 04:33:05 UTC

AV detection:

22 of 29 (75.86%)

Threat level:

5/5

Detection(s):

Malicious file

Link:

https://check.spamhaus.org/check/?searchterm=rh7fqj3ogvvzz77tdau7grwjanr7edoz3ga5ujer3mfxyz7xp2da._file

Verdict:

malicious

Label(s):

zloader

Result

Malware family:

n/a

Score:

1/10

Tags:

n/a

Link:

https://tria.ge/reports/201007-zw3144skqa/

Behaviour

Suspicious use of WriteProcessMemory

Unpacked files

SH256 hash:

89fe58276e356b9cfff31829f346c90363f20dd9d981da2491db0b7c67f77e86

MD5 hash:

425e8b1aa7e97b261d5876257bed8698

SHA1 hash:

9f8a7bb9869ceeb5bd18f78b480f125b547bc7a2

Link:

https://www.unpac.me/results/34bda7a1-03e7-4c0a-89b9-1f9cc1606d82/

SH256 hash:

131c8e4893b38f5aa6206f66b26a3ee91a7d5e8add34803cbd15db8be53a4a5f

MD5 hash:

36081fc8cdcfaf894ec078353ebaabdf

SHA1 hash:

a06a760310965e97b7bd0d539328252bd3d717b8

Link:

https://www.unpac.me/results/34bda7a1-03e7-4c0a-89b9-1f9cc1606d82/

SH256 hash:

fc6b1e383e15fd6c059e0bac1efb19a2d884231e97ae65621582355ea4eabfed

MD5 hash:

8acacfcc4313cc06f5e900864eed6962

SHA1 hash:

ea73dc25ab8a60679048d3c102fa7c06faac91e4

Detections:

win_zloader_auto

Link:

https://www.unpac.me/results/34bda7a1-03e7-4c0a-89b9-1f9cc1606d82/

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Legit

Score:

0.00

Link:

https://yomi.yoroi.company/submissions/89fe58276e356b9cfff31829f346c90363f20dd9d981da2491db0b7c67f77e86

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	win_zloader_auto Create hunting rule
Author:	Felix Bilstein - yara-signator at cocacoding dot com
Description:	autogenerated rule brought to you by yara-signator