Overview

overview

10

Static

static

SecuriteIn...14.dll

windows7_x64

10

SecuriteIn...14.dll

windows10_x64

3

Sharing

Copy URL Twitter E-mail

General

  • Target
    SecuriteInfo.com.Mal.EncPk-APV.27854.18614
  • Size 333KB
  • Sample200715-4lmxmkzz7n
  • SHA256 0b5a7876121672a2ad042ba26d57e186b6f1c9b07daa32c2fe4864c56c2e9c4f
  • MD5 SHA1 SHA512
Score
10/10
zloaderspamnspamnbotnettrojan

Malware Config

Extracted

Family

  • zloader

Botnet

  • spamn

Campaign

  • spamn

C2

  • https://calmstill.xyz/off.php

  • SFGh67fdjwsjJEg5

  • eX�A�ץ�K8�z�d�or�����"t��r�҂.�ߨ=��FE�hI�j��En�PsO��<��M �KN��;4�Y �8��\ �q������8Gp�;�pm!g

rc4.plain

Targets

    • Target
      SecuriteInfo.com.Mal.EncPk-APV.27854.18614
    • Size 333KB
    • SHA256 0b5a7876121672a2ad042ba26d57e186b6f1c9b07daa32c2fe4864c56c2e9c4f
    • MD5 SHA1 SHA512
    Score
    10/10
    trojanbotnetzloader

    • Suspicious use of NtCreateUserProcessOtherParentProcess

    • Zloader, Terdot, DELoader, ZeusSphinx

      Zloader is a malware strain that was initially discovered back in August 2015.

      trojanbotnetzloader

    • Blacklisted process makes network request

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks