MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 fa5758be81ae8ec4d4f2c4f403a9caa31fd6508100d3cd718190ab9320f3eba4. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


ZLoader


Vendor detections: 10


Intelligence 10 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: fa5758be81ae8ec4d4f2c4f403a9caa31fd6508100d3cd718190ab9320f3eba4
SHA3-384 hash: 1ab9993a7b42abeeb638b54403c3cbd5c089a596de4861db4258dfe0519cadc34913eabf8888f2e7cbded37300bdedaf
SHA1 hash: 935a5c5404833d0fa049dfbdec302bcd87e9a1cc
MD5 hash: 417be31cf5316bc66a340b1d47af187e
humanhash: cup-stream-lemon-quebec
File name:fa5758be81ae8ec4d4f2c4f403a9caa31fd6508100d3cd718190ab9320f3eba4.dll
Download: download sample
Signature ZLoader
Create hunting rule
File size:585'728 bytes
First seen:2020-10-20 15:32:22 UTC
Last seen:Never
File type:DLL dll
MIME type:application/x-dosexec
imphash 12370bc90c1f7942c66469afbdb625f9 (2 x ZLoader)
ssdeep 12288:cPAHM4Qd+m3CDMpLVd53TpEPyBU5RHwOgQLg8fHHRI2TF1:qYjQ73CDMpHTp1U5RHwOfxH7Tz
Threatray 37 similar samples on MalwareBazaar
TLSH 99C4E0133686D53AC66AC239CD85EDFC96957D09EEA46C4330C53F4F3A32A518B39B06
Reporter Secu0133
Tags:dll ZLoader

Intelligence

File Origin
# of uploads :
1
# of downloads :
92
Origin country :
n/a
Vendor Threat Intelligence
Detection:
Zloader
Create hunting rule
Link:
https://www.capesandbox.com/analysis/73570/
Detection(s):
SecuriteInfo.com.Generic.mg.417be31cf5316bc6.22140.UNOFFICIAL
Create hunting rule

Result
Verdict:
Clean
Maliciousness:

Behaviour
Sending a UDP request
Creating a file in the %temp% directory
Delayed writing of the file
Delayed reading of the file
Result
Threat name:
Unknown
Detection:
malicious
Classification:
n/a
Score:
48 / 100
Link:
https://www.joesandbox.com/analysis/498444
Signature
(
)
.
a
b
c
D
e
f
g
h
I
k
l
m
n
o
r
S
t
u
w
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 301218 Sample: 7wXLmylRKg.dll Startdate: 20/10/2020 Architecture: WINDOWS Score: 48 14 Snort IDS alert for network traffic (e.g. based on Emerging Threat rules) 2->14 6 loaddll32.exe 1 2->6         started        8 msiexec.exe 2->8         started        process3 process4 10 rundll32.exe 6->10         started        12 rundll32.exe 1 6->12         started       
Detection:
zloader
Create hunting rule
Link:
https://mwdb.cert.pl/sample/fa5758be81ae8ec4d4f2c4f403a9caa31fd6508100d3cd718190ab9320f3eba4/
Threat name:
Win32.Trojan.ZLoader
Create hunting rule
Status:
Malicious
First seen:
2020-10-20 15:34:05 UTC
AV detection:
21 of 29 (72.41%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=7jlvrpubv2hmjvhsyt2ahkokump5muebadj424mbscvzgiht5osa._file
Verdict:
malicious
Label(s):
zloader
Create hunting rule
Similar samples:
0c706ecdd8cb4393779872471c38ad5286f4883107e75835a91f007815e7413a
ZLoader
49d7303aab08fdc92f4a19e794ff05b82b4286d2793cdef0f85821b7201ccacb
ZLoader
6058c6ad67825611365e2b30a4e8641f898a1f04c3d4edc4fc228ea7a5b5cb20
ZLoader
782ea4a6943ceafa3d1133c5cbba0bbb6cdd88953ffae7ab89ac8a7f79101e0a
ZLoader
7888b57934a7de6293d3681f9758f80a2c41f657b36412fcecdb7cde13842b32
ZLoader
78e34b21a5786410919826ed63c6c65ced1120074800f7349e772476cdbafc78
ZLoader
7a95f603035c2c64027d526ef17f75b4b8bb1b92a0c6e8c06ea639f89a83370c
ZLoader
ad213eaf7436c9ebd4d1e3fe24ce4963a8d878b1b625198d5c8085c383f580dd
ZLoader
ea2f669164d78dda6cfa73ec8cf823944855d3cd711714694bde177feba932f9
ZLoader
f541c495c3b6652928198822b24a27cce575ee1c8c2d6a0e42805cdbf8da59e8
ZLoader
+ 27 additional samples on MalwareBazaar
Result
Malware family:
zloader
Create hunting rule
Score:
  10/10
Tags:
trojan botnet family:zloader
Link:
https://tria.ge/reports/201020-1585t4m92a/
Behaviour
Suspicious use of WriteProcessMemory
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of SetThreadContext
Blacklisted process makes network request
Suspicious use of NtCreateUserProcessOtherParentProcess
Zloader, Terdot, DELoader, ZeusSphinx
Malware Config
C2 Extraction:
http://kentyckyderby201000.com/web/post.php
http://deemberkentyucky101.com/web/post.php
http://decemberkentuck102981.com/web/post.php
http://wingtonwelbemdon.com/web/post.php
http://donburitimesofindia.com/web/post.php
http://celtictimesofkarishan.com/web/post.php
Unpacked files
SH256 hash:
7f8ba3d850bc3f0ab491ec1d46507e3c0d887a7a574b7166a8ad356352bf0663
MD5 hash:
0cc62ffc8a4788af16d7ba58b442f8f1
SHA1 hash:
f82bf00efcc0bb1cdc43ac91c0c496d70a263bf1
Detections:
win_zloader_auto
Create hunting rule
Link:
https://www.unpac.me/results/1f761368-198a-40c4-8268-36c4c04beed3/
SH256 hash:
fa5758be81ae8ec4d4f2c4f403a9caa31fd6508100d3cd718190ab9320f3eba4
MD5 hash:
417be31cf5316bc66a340b1d47af187e
SHA1 hash:
935a5c5404833d0fa049dfbdec302bcd87e9a1cc
Link:
https://www.unpac.me/results/1f761368-198a-40c4-8268-36c4c04beed3/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Trojan
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/fa5758be81ae8ec4d4f2c4f403a9caa31fd6508100d3cd718190ab9320f3eba4

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/73570/

Comments