Overview

overview

10

Static

static

x.dll

windows7_x64

10

x.dll

windows10_x64

10

Resubmissions

04-03-2021 12:53

210304-xck4l4syjs 10

12-05-2020 16:48

200512-fh9ngk8kpj 10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    x.dll

  • Size

    800KB

  • Sample

    200512-fh9ngk8kpj

  • MD5

    c1366b1afc57e2fca68501345bbd4ba0

  • SHA1

    1dbbc632e2b10918c322ed0e761661fbe690d43e

  • SHA256

    692c58e28e0f0346adfbad2356dd8495ec8f07718ee40db171b50e8870526f96

  • SHA512

    ad290473ef61838d67fbf2812d381519b1fabbb50e15c088cd45fe6ea4d9d27ed6615bbffb459dccfdad116706989c881db96fceeef9a94180310c5db5c3b80c

Score
10/10
zloaderbotnetevasionpersistencespywaretrojan

Malware Config

Targets

    • Target

      x.dll

    • Size

      800KB

    • MD5

      c1366b1afc57e2fca68501345bbd4ba0

    • SHA1

      1dbbc632e2b10918c322ed0e761661fbe690d43e

    • SHA256

      692c58e28e0f0346adfbad2356dd8495ec8f07718ee40db171b50e8870526f96

    • SHA512

      ad290473ef61838d67fbf2812d381519b1fabbb50e15c088cd45fe6ea4d9d27ed6615bbffb459dccfdad116706989c881db96fceeef9a94180310c5db5c3b80c

    Score
    10/10
    trojanbotnetzloaderevasionspywarepersistence

    • Zloader, Terdot, DELoader, ZeusSphinx

      Zloader is a malware strain that was initially discovered back in August 2015.

      trojanbotnetzloader

    • Blacklisted process makes network request

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spyware

    • Modifies system certificate store

      evasionspywaretrojan

    • Modifies service

      persistence

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Modify Existing Service

1
T1031

Privilege Escalation

Defense Evasion

Install Root Certificate

1
T1130

Modify Registry

2
T1112

Credential Access

Credentials in Files

1
T1081

Discovery

Remote System Discovery

1
T1018

Lateral Movement

Collection

Data from Local System

1
T1005

Exfiltration

Command and Control

Impact

Tasks