MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 9fde971b9df0e8944242b3517e851447d1a2ab20e295d33c3355440bd24aad8a. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

ZLoader

Vendor detections: 6

Intelligence 6 IOCs YARA 1 File information Comments

SHA256 hash:	9fde971b9df0e8944242b3517e851447d1a2ab20e295d33c3355440bd24aad8a
SHA3-384 hash:	c17043786b9779cc6431017b750eb3389a95e4c3d14a5271a3110c793648f574cca4da4cd614d2eec3ad890eece09b6b
SHA1 hash:	5af8c24c2b2145e642b6eff7bcb207efb09e5e4e
MD5 hash:	eed569f8675afca08fe7d508602af5a0
humanhash:	tennis-florida-hydrogen-music
File name:	eed569f8675afca08fe7d508602af5a0.dll
Download:	download sample
Signature	ZLoader Create hunting rule
File size:	439'640 bytes
First seen:	2020-10-07 04:29:48 UTC
Last seen:	Never
File type:	dll
MIME type:	application/x-dosexec
imphash	4fd12319308b8413e33cf68fb63d30b5 (9 x ZLoader)
ssdeep	6144:hoPMXLGnQE9NphY64U/jMIuxF8RrnFnknZn3nRmn/nlnenvnxnGn5nPYnhnpanPA:6PMbGnLphKeMIuxKRi
Threatray	12 similar samples on MalwareBazaar
TLSH	68943E1ABCC04E9FD76A49B63DA41324169EED1D4751F10F87E4F662F0B0BF2AE90189
Reporter	abuse_ch
Tags:	dll ZLoader

abuse_ch

ZLoader C2s:
fqnvtcpheas.su
fqnvtmqass.ru
fqnvsdaas.su
fqnesas.ru

Intelligence

File Origin

# of uploads :

# of downloads :

Origin country :

n/a

Vendor Threat Intelligence

Gathering data

Result

Verdict:

Clean

Maliciousness:

Behaviour

Sending a UDP request

Result

Threat name:

Unknown

Detection:

malicious

Classification:

evad

Score:

56 / 100

Link:

https://www.joesandbox.com/analysis/483535

Signature

Allocates memory in foreign processes

Contains functionality to inject code into remote processes

Creates autostart registry keys with suspicious values (likely registry only malware)

Writes to foreign memory regions

Behaviour

Behavior Graph:

Download SVG

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/9fde971b9df0e8944242b3517e851447d1a2ab20e295d33c3355440bd24aad8a/

Threat name:

Win32.Trojan.ZLoader

Status:

Malicious

First seen:

2020-10-07 04:31:25 UTC

AV detection:

21 of 29 (72.41%)

Threat level:

5/5

Detection(s):

Malicious file

Link:

https://check.spamhaus.org/check/?searchterm=t7pjog456dujiqscwnix5biui7i2fkza4kk5gpbtkvcaxuskvwfa._file

Verdict:

malicious

Label(s):

zloader

Result

Malware family:

n/a

Score:

1/10

Tags:

n/a

Link:

https://tria.ge/reports/201007-331npabe5j/

Behaviour

Suspicious use of WriteProcessMemory

Unpacked files

SH256 hash:

9fde971b9df0e8944242b3517e851447d1a2ab20e295d33c3355440bd24aad8a

MD5 hash:

eed569f8675afca08fe7d508602af5a0

SHA1 hash:

5af8c24c2b2145e642b6eff7bcb207efb09e5e4e

Link:

https://www.unpac.me/results/185f3022-eedc-4040-b15f-aa1c8b6e3b1b/

SH256 hash:

840fffd341455b82e7de72a7c2bcf674b39a8267b35ab2f7889e477384388d00

MD5 hash:

aad41404da308bdc89711b1e50cac72f

SHA1 hash:

80b69b2ec492be3ec4b877834dac04e4fd0530d6

Detections:

win_zloader_auto

Link:

https://www.unpac.me/results/185f3022-eedc-4040-b15f-aa1c8b6e3b1b/

SH256 hash:

389ac3cc08ebbf6d45e360ba62f29e5b602d548bf127acff9296978d8db18585

MD5 hash:

9d32588434c377db5dbae71913289332

SHA1 hash:

9a7e85323d6389803b4f4e0616a3c09c8351c409

Link:

https://www.unpac.me/results/185f3022-eedc-4040-b15f-aa1c8b6e3b1b/

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Legit

Score:

0.00

Link:

https://yomi.yoroi.company/submissions/9fde971b9df0e8944242b3517e851447d1a2ab20e295d33c3355440bd24aad8a

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	win_zloader_auto Create hunting rule
Author:	Felix Bilstein - yara-signator at cocacoding dot com
Description:	autogenerated rule brought to you by yara-signator