Overview

overview

10

Static

static

w.dll

windows7_x64

10

w.dll

windows10_x64

10

Resubmissions

04-03-2021 13:48

210304-6k8nxhjlda 10

05-06-2020 16:46

200605-edh9dgsrjn 10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    w.dll

  • Size

    492KB

  • Sample

    200605-edh9dgsrjn

  • MD5

    892fbc87fdbcbe9d91e17ae7355eb54c

  • SHA1

    c0e25d2f02a768def644be6c248732da4f91495b

  • SHA256

    67b46301815d5ba32f90af114a459810902ba6d97a75821c8455b8103073b499

  • SHA512

    09c30eef3c57be57ef396ff1c2de92f0cff1b57bea0e56ab6401b844b4c5982c7a56f3ef708d0aff2bb6ea1baaef5cf39098b6623bc529c579b35ad73ea4039a

Score
10/10
zloaderbotnetevasionspywaretrojan

Malware Config

Targets

    • Target

      w.dll

    • Size

      492KB

    • MD5

      892fbc87fdbcbe9d91e17ae7355eb54c

    • SHA1

      c0e25d2f02a768def644be6c248732da4f91495b

    • SHA256

      67b46301815d5ba32f90af114a459810902ba6d97a75821c8455b8103073b499

    • SHA512

      09c30eef3c57be57ef396ff1c2de92f0cff1b57bea0e56ab6401b844b4c5982c7a56f3ef708d0aff2bb6ea1baaef5cf39098b6623bc529c579b35ad73ea4039a

    Score
    10/10
    trojanbotnetzloaderevasionspyware

    • Zloader, Terdot, DELoader, ZeusSphinx

      Zloader is a malware strain that was initially discovered back in August 2015.

      trojanbotnetzloader

    • Blacklisted process makes network request

    • Modifies system certificate store

      evasionspywaretrojan

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Install Root Certificate

1
T1130

Modify Registry

1
T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks