zloader | a51d5fe8c5f9ea9c4af866b7b6669845433934e4b4528995a3ac1702e7002c0e | Triage

Resubmissions

24-01-2024 08:17

240124-j6t41adgg8 10

24-01-2024 07:52

240124-jqd3vadcfj 10

23-01-2024 11:54

240123-n28ttaafc8 10

24-06-2020 13:13

200624-qjwbdtfea2 10

Sharing

General

Target

june23.dll
Size

383KB
Sample

200624-qjwbdtfea2
MD5

7e889962ed9651933c46faa6f7b5ab6d
SHA1

015639fe2a6af8d9205e0fb36226c9d134b49fd8
SHA256

a51d5fe8c5f9ea9c4af866b7b6669845433934e4b4528995a3ac1702e7002c0e
SHA512

914e07996a14bd4499b91333ab0de65748e5617d543dd0eff3a269d24a542f15cbe1dca7be618843c0d7fb60dcaf96e20e5de95ac2989dc48850ab1a10aa8ff2

Score

10^/10

zloader botnet persistence spyware trojan

Malware Config

Targets

- Target
  
  june23.dll
- Size
  
  383KB
- MD5
  
  7e889962ed9651933c46faa6f7b5ab6d
- SHA1
  
  015639fe2a6af8d9205e0fb36226c9d134b49fd8
- SHA256
  
  a51d5fe8c5f9ea9c4af866b7b6669845433934e4b4528995a3ac1702e7002c0e
- SHA512
  
  914e07996a14bd4499b91333ab0de65748e5617d543dd0eff3a269d24a542f15cbe1dca7be618843c0d7fb60dcaf96e20e5de95ac2989dc48850ab1a10aa8ff2
Score

10^/10

persistence trojan botnet zloader spyware
- Zloader, Terdot, DELoader, ZeusSphinx
  Zloader is a malware strain that was initially discovered back in August 2015.
  trojan botnet zloader
- Blacklisted process makes network request
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware
- Modifies service
  persistence
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Modify Existing Service

Privilege Escalation

Defense Evasion

Modify Registry

Credential Access

Credentials in Files

Discovery

Remote System Discovery

Lateral Movement

Collection

Data from Local System

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

persistencetrojanbotnetzloader

behavioral2

trojanbotnetzloaderspyware