Overview

overview

10

Static

static

wp-keys_php.dll

windows7_x64

10

wp-keys_php.dll

windows10_x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    wp-keys_php
  • Size 483KB
  • Sample200702-7k787pd2ee
  • SHA256 cf90fce260606f17508445c8347dc274157bd269c002fd705ab168be96f28538
  • MD5 SHA1 SHA512
Score
10/10
zloaderbotnetevasionspywaretrojan

Malware Config

Targets

    • Target
      wp-keys_php
    • Size 483KB
    • SHA256 cf90fce260606f17508445c8347dc274157bd269c002fd705ab168be96f28538
    • MD5 SHA1 SHA512
    Score
    10/10
    trojanbotnetzloaderevasionspyware

    • Suspicious use of NtCreateUserProcessOtherParentProcess

    • Zloader, Terdot, DELoader, ZeusSphinx

      Zloader is a malware strain that was initially discovered back in August 2015.

      trojanbotnetzloader

    • Blacklisted process makes network request

    • Modifies system certificate store

      evasionspywaretrojan

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks