Overview

overview

10

Static

static

202.dll

windows7_x64

10

202.dll

windows10_x64

3

Sharing

Copy URL
Twitter E-mail

General

  • Target

    202.dll

  • Size

    387KB

  • Sample

    200720-5x3nxkcx7j

  • MD5

    d807f97e41c73e54984ebe5a5228be7a

  • SHA1

    3ee769477a72b6dbc39cfed759e6f58d16a96151

  • SHA256

    4fb5e1b5eaa6a8f4ff3e80429adaa9f5af1dded814c724a7839f25636530d0e3

  • SHA512

    36f1fd0b2d7efde2cbd2a76f2986517b3f1917fe3882f5eaf42cc1ac7087370969f6c2627b2662bc1a73f705c57d8a15a093a26a12ec9e479f693a58c46f6d81

Score
10/10
zloaderdllobnovadllnewhehbotnetpersistencespywaretrojan

Malware Config

Extracted

Family

zloader

Botnet

DLLobnova

Campaign

dllnewheh

C2

https://dsdjfhdsufudhjas.name/gate.php

https://dsdjfhd9ddksaas.com/gate.php

https://dsdjfhdsufudhjas.pw/gate.php

https://dsdjfhd9ddksaas.ru/gate.php

https://dsdjfhdsufudhjas.su/gate.php

https://kdsadisadijdsasm2.com/gate.php

https://dsdjfhdsufudhjas.net/gate.php

https://dsdjfhd9ddksaas.eu/gate.php

03d5ae30a0bd934a23b6a7f0756aa504
rc4.plain

Targets

    • Target

      202.dll

    • Size

      387KB

    • MD5

      d807f97e41c73e54984ebe5a5228be7a

    • SHA1

      3ee769477a72b6dbc39cfed759e6f58d16a96151

    • SHA256

      4fb5e1b5eaa6a8f4ff3e80429adaa9f5af1dded814c724a7839f25636530d0e3

    • SHA512

      36f1fd0b2d7efde2cbd2a76f2986517b3f1917fe3882f5eaf42cc1ac7087370969f6c2627b2662bc1a73f705c57d8a15a093a26a12ec9e479f693a58c46f6d81

    Score
    10/10
    persistencespywaretrojanbotnetzloader

    • Zloader, Terdot, DELoader, ZeusSphinx

      Zloader is a malware strain that was initially discovered back in August 2015.

      trojanbotnetzloader

    • Blacklisted process makes network request

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spyware

    • Adds Run key to start application

      persistence

    • Modifies service

      persistence

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Command-Line Interface

1
T1059

Persistence

Registry Run Keys / Startup Folder

1
T1060

Modify Existing Service

1
T1031

Privilege Escalation

Defense Evasion

Modify Registry

3
T1112

Install Root Certificate

1
T1130

Credential Access

Credentials in Files

1
T1081

Discovery

Remote System Discovery

1
T1018

System Information Discovery

1
T1082

Lateral Movement

Collection

Data from Local System

1
T1005

Exfiltration

Command and Control

Impact

Tasks