Overview

overview

10

Static

static

SecuriteIn...27.dll

windows7_x64

10

SecuriteIn...27.dll

windows10_x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    SecuriteInfo.com.Variant.Zusy.307926.26624.1627
  • Size 579KB
  • Sample200630-arjtw3tkmx
  • SHA256 17ddc83d49b6cd1d511e8c5498c44d8b4bdbbb69b13011a180f8bded117ff2f7
  • MD5 SHA1 SHA512
Score
10/10
zloaderbotnetevasionspywaretrojan

Malware Config

Targets

    • Target
      SecuriteInfo.com.Variant.Zusy.307926.26624.1627
    • Size 579KB
    • SHA256 17ddc83d49b6cd1d511e8c5498c44d8b4bdbbb69b13011a180f8bded117ff2f7
    • MD5 SHA1 SHA512
    Score
    10/10
    trojanbotnetzloaderevasionspyware

    • Suspicious use of NtCreateUserProcessOtherParentProcess

    • Zloader, Terdot, DELoader, ZeusSphinx

      Zloader is a malware strain that was initially discovered back in August 2015.

      trojanbotnetzloader

    • Blacklisted process makes network request

    • Modifies system certificate store

      evasionspywaretrojan

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks