Overview

overview

10

Static

static

f47c8344d0...ad.exe

windows7_x64

10

f47c8344d0...ad.exe

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    f47c8344d02912d11b3b0a5614abf0ad.exe

  • Size

    2.3MB

  • Sample

    200624-bybscl9vfn

  • MD5

    f47c8344d02912d11b3b0a5614abf0ad

  • SHA1

    5afedd6930a1940e915b37242ff762b847fdecc2

  • SHA256

    62dc32e85cf808c08cc70ef2de4028fcfd20a1e91d5aa88b1280d353faff5313

  • SHA512

    3dad818f0894938ff7a9e5e4989946cb862f08adf615ae1d9d15e3ee60bd152cc0f0b31590a8952ccb6aaee5ae1a484410fb601b4d5ca5395991a919d71708da

Score
10/10
zloaderbot7bot7botnetpersistencetrojan

Malware Config

Extracted

Family

zloader

Botnet

bot7

Campaign

bot7

C2

https://militanttra.at/owg.php

NvuVIV3kbg7
rc4.plain

Targets

    • Target

      f47c8344d02912d11b3b0a5614abf0ad.exe

    • Size

      2.3MB

    • MD5

      f47c8344d02912d11b3b0a5614abf0ad

    • SHA1

      5afedd6930a1940e915b37242ff762b847fdecc2

    • SHA256

      62dc32e85cf808c08cc70ef2de4028fcfd20a1e91d5aa88b1280d353faff5313

    • SHA512

      3dad818f0894938ff7a9e5e4989946cb862f08adf615ae1d9d15e3ee60bd152cc0f0b31590a8952ccb6aaee5ae1a484410fb601b4d5ca5395991a919d71708da

    Score
    10/10
    trojanbotnetzloaderpersistence

    • Zloader, Terdot, DELoader, ZeusSphinx

      Zloader is a malware strain that was initially discovered back in August 2015.

      trojanbotnetzloader

    • Blacklisted process makes network request

    • Adds Run entry to start application

      persistence

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1
T1060

Privilege Escalation

Defense Evasion

Modify Registry

1
T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks