Resubmissions

31-01-2024 21:42

240131-1ktpsadab6 10

24-01-2024 07:47

240124-jml92sdcd6 10

23-01-2024 11:54

240123-n25r6ahhfk 10

24-06-2020 13:36

200624-enc457kzrj 10

General

  • Target

    A004BC8B4F3DB1EF5A66579B9746B5B1.bin

  • Size

    424KB

  • Sample

    200624-enc457kzrj

  • MD5

    a004bc8b4f3db1ef5a66579b9746b5b1

  • SHA1

    88a5fcebfd7a037a9ca9573772ac2334a61b25de

  • SHA256

    42bb5eae534eb2cea979c300b797a65febf291b28aea0b9d8bbea7d0a41bffa2

  • SHA512

    28aed111b2ecea90c2da03871f36272b8680d392c245fdf0e2f4d4454974a3a51d6744133cecfc2576bbc778742f9b824e8355026b53d029d13ff79bb2136f9b

Malware Config

Targets

    • Target

      A004BC8B4F3DB1EF5A66579B9746B5B1.bin

    • Size

      424KB

    • MD5

      a004bc8b4f3db1ef5a66579b9746b5b1

    • SHA1

      88a5fcebfd7a037a9ca9573772ac2334a61b25de

    • SHA256

      42bb5eae534eb2cea979c300b797a65febf291b28aea0b9d8bbea7d0a41bffa2

    • SHA512

      28aed111b2ecea90c2da03871f36272b8680d392c245fdf0e2f4d4454974a3a51d6744133cecfc2576bbc778742f9b824e8355026b53d029d13ff79bb2136f9b

    • Zloader, Terdot, DELoader, ZeusSphinx

      Zloader is a malware strain that was initially discovered back in August 2015.

    • Blacklisted process makes network request

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v6

Tasks