Overview

overview

10

Static

static

rVuj5bF.bin.dll

windows7_x64

10

rVuj5bF.bin.dll

windows10_x64

10

Resubmissions

05-03-2021 05:53

210305-jqn2paptcs 10

24-06-2020 14:54

200624-4a9fpsftlx 10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    rVuj5bF.bin

  • Size

    403KB

  • Sample

    200624-4a9fpsftlx

  • MD5

    4e9d3907d80cfe903df735b855d5eaeb

  • SHA1

    3fcc74d0b646e8324f0a4cf4708890a8261f3e84

  • SHA256

    280fedf6fd7e0964222ac9b21bcc289c222c7ea91d7bad6350741bdf8c1f0938

  • SHA512

    672b8b0dd776ff156504e55c171fe035e5aac7b1b48ae785973113648717317eb611acbcc6141c5ab6c0096c4f41c24c335d957afbca1fddcf15dfde9750361f

Score
10/10
zloaderbotnetspywaretrojan

Malware Config

Targets

    • Target

      rVuj5bF.bin

    • Size

      403KB

    • MD5

      4e9d3907d80cfe903df735b855d5eaeb

    • SHA1

      3fcc74d0b646e8324f0a4cf4708890a8261f3e84

    • SHA256

      280fedf6fd7e0964222ac9b21bcc289c222c7ea91d7bad6350741bdf8c1f0938

    • SHA512

      672b8b0dd776ff156504e55c171fe035e5aac7b1b48ae785973113648717317eb611acbcc6141c5ab6c0096c4f41c24c335d957afbca1fddcf15dfde9750361f

    Score
    10/10
    trojanbotnetzloaderspyware

    • Zloader, Terdot, DELoader, ZeusSphinx

      Zloader is a malware strain that was initially discovered back in August 2015.

      trojanbotnetzloader

    • Blacklisted process makes network request

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spyware

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

1
T1081

Discovery

Remote System Discovery

1
T1018

Lateral Movement

Collection

Data from Local System

1
T1005

Exfiltration

Command and Control

Impact

Tasks