MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 f3a538a0a43dc9a99a00e760764a0d43517beb25e832e763538ed29b5a9db058. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

ZLoader

Vendor detections: 6

Intelligence 6 IOCs YARA 2 File information Comments

SHA256 hash:	f3a538a0a43dc9a99a00e760764a0d43517beb25e832e763538ed29b5a9db058
SHA3-384 hash:	e4684e48d24790a6f3b44727fdf344a5287fcc9e9f90b35891ed8656231ce762f701cdba0a161bc2acfcd8a26991f687
SHA1 hash:	4c3a5c1779676758b7f736f5c2fd2cdcd6e31b47
MD5 hash:	fa7ad76b346b6cd410c3d53616cf28e8
humanhash:	earth-kansas-robert-robin
File name:	fa7ad76b346b6cd410c3d53616cf28e8.dll
Download:	download sample
Signature	ZLoader Create hunting rule
File size:	439'640 bytes
First seen:	2020-10-07 04:31:48 UTC
Last seen:	Never
File type:	dll
MIME type:	application/x-dosexec
imphash	6a88e6a187ec120eacfe2e6648b79067 (5 x ZLoader)
ssdeep	6144:ooPMXLGnQE9NphY64U/jMIuxF8RrnFnknZn3nRmn/nlnenvnxnGn5nPYnhnpanPl:1PMbGnLphKeMIuxKR0I/
Threatray	19 similar samples on MalwareBazaar
TLSH	C5943E1ABCC04E9FD36A49B63DA51324169EED1D4751F10F87E4F662F0B0BF2AE90189
Reporter	abuse_ch
Tags:	dll ZLoader

abuse_ch

ZLoader C2s:
fqnvtcpheas.su
fqnvtmqass.ru
fqnvsdaas.su
fqnesas.ru

Intelligence

File Origin

# of uploads :

# of downloads :

Origin country :

n/a

Vendor Threat Intelligence

Gathering data

Result

Verdict:

Clean

Maliciousness:

Behaviour

Sending a UDP request

Result

Threat name:

Unknown

Detection:

malicious

Classification:

evad

Score:

80 / 100

Link:

https://www.joesandbox.com/analysis/483554

Signature

Allocates memory in foreign processes

Antivirus detection for URL or domain

Contains functionality to inject code into remote processes

Creates autostart registry keys with suspicious values (likely registry only malware)

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Writes to foreign memory regions

Behaviour

Behavior Graph:

Download SVG

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/f3a538a0a43dc9a99a00e760764a0d43517beb25e832e763538ed29b5a9db058/

Threat name:

Win32.Trojan.ZLoader

Status:

Malicious

First seen:

2020-10-07 04:33:06 UTC

AV detection:

22 of 29 (75.86%)

Threat level:

5/5

Detection(s):

Malicious file

Link:

https://check.spamhaus.org/check/?searchterm=6ostrifehxe2tgqa45qhmsqninixx2zf5azooy2tr3jjwwu5wbma._file

Verdict:

malicious

Label(s):

zloader

Result

Malware family:

n/a

Score:

1/10

Tags:

n/a

Link:

https://tria.ge/reports/201007-25nblkkhva/

Behaviour

Suspicious use of WriteProcessMemory

Unpacked files

SH256 hash:

f3a538a0a43dc9a99a00e760764a0d43517beb25e832e763538ed29b5a9db058

MD5 hash:

fa7ad76b346b6cd410c3d53616cf28e8

SHA1 hash:

4c3a5c1779676758b7f736f5c2fd2cdcd6e31b47

Link:

https://www.unpac.me/results/68d45132-76d4-46fc-848f-24b19f8620f6/

SH256 hash:

d2339f6fe1a41c96f33f4ac839c022de8359cfcc99bfa373d01e98f028092eb1

MD5 hash:

ec3c8f4ebba85277d31bd7870422d6b4

SHA1 hash:

177d6f7b6c3f574e0dd79cdd5cb0c66fe73aa4ba

Detections:

win_zloader_auto

Link:

https://www.unpac.me/results/68d45132-76d4-46fc-848f-24b19f8620f6/

SH256 hash:

4537429d7de8671dbcaed3a46d039cd707aec9708dbb4031ae16612371ee4a87

MD5 hash:

2e3f671ff49534e672c85cfe2cd1b85a

SHA1 hash:

59d46f167e76a632a7880baa62e1b71ab420d968

Link:

https://www.unpac.me/results/68d45132-76d4-46fc-848f-24b19f8620f6/

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Legit

Score:

0.00

Link:

https://yomi.yoroi.company/submissions/f3a538a0a43dc9a99a00e760764a0d43517beb25e832e763538ed29b5a9db058

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	win_zloader_auto Create hunting rule
Author:	Felix Bilstein - yara-signator at cocacoding dot com
Description:	autogenerated rule brought to you by yara-signator

Rule name:	with_sqlite Create hunting rule
Author:	Julian J. Gonzalez <info@seguridadparatodos.es>
Description:	Rule to detect the presence of SQLite data in raw image
Reference:	http://www.st2labs.com