Overview

overview

10

Static

static

3cf5f3676b...55.dll

windows7_x64

10

3cf5f3676b...55.dll

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    3cf5f3676b792e44749030150a0a0f55.dll

  • Size

    504KB

  • Sample

    200814-pblknxnw66

  • MD5

    3cf5f3676b792e44749030150a0a0f55

  • SHA1

    8af704ed880f4a85dc33779a716187f2c3ba8e99

  • SHA256

    13509b3f6aeacb569938cc1baa474beac1c0e6d1ce222ca681d9d463889babac

  • SHA512

    b103583c441d6012969f176603896808eaf4d114be09c992486b0fef7e2c8abaeb899f15c694189317e3b67fa1c4066bfab79d000244ec6ea2f8989f2666b53b

Score
10/10
zloadernut14/08botnettrojan

Malware Config

Extracted

Family

zloader

Botnet

nut

Campaign

14/08

C2

https://girldowcahohorme.tk/wp-parsing.php

http://thegamegolfmagazine.com/wp-parsing.php

http://truvaluconsulting.com/wp-parsing.php

https://blog2.textbookrush.com/wp-parsing.php

https://curiosidadez.com.br/wp-parsing.php

https://nonchothetohear.cf/wp-parsing.php

https://sicupira8.com.br/wp-parsing.php

https://titaniumgamers.com/wp-parsing.php
rc4.plain
rsa_pubkey.plain

Targets

    • Target

      3cf5f3676b792e44749030150a0a0f55.dll

    • Size

      504KB

    • MD5

      3cf5f3676b792e44749030150a0a0f55

    • SHA1

      8af704ed880f4a85dc33779a716187f2c3ba8e99

    • SHA256

      13509b3f6aeacb569938cc1baa474beac1c0e6d1ce222ca681d9d463889babac

    • SHA512

      b103583c441d6012969f176603896808eaf4d114be09c992486b0fef7e2c8abaeb899f15c694189317e3b67fa1c4066bfab79d000244ec6ea2f8989f2666b53b

    Score
    10/10
    trojanbotnetzloader

    • Suspicious use of NtCreateUserProcessOtherParentProcess

    • Zloader, Terdot, DELoader, ZeusSphinx

      Zloader is a malware strain that was initially discovered back in August 2015.

      trojanbotnetzloader

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks