Overview

overview

10

Static

static

SecuriteIn...83.dll

windows7_x64

10

SecuriteIn...83.dll

windows10_x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    SecuriteInfo.com.Generic.mg.22c1b894002c6ffd.12583
  • Size 723KB
  • Sample200827-3skv3kjde2
  • SHA256 c91229d90c423cd5b5bf870cec714e5c956058c62f4b2036607d44f1767c50d2
  • MD5 SHA1 SHA512
Score
10/10
zloaderbat1k3bat1k3botnettrojan

Malware Config

Extracted

Family

  • zloader

Botnet

  • bat1k3

Campaign

  • bat1k3

C2

  • http://as9897234135.xyz/LKhwojehDgwegSDG/gateJKjdsh.php

  • http://as9897234135.org/LKhwojehDgwegSDG/gateJKjdsh.php

  • http://as9897234135.net/LKhwojehDgwegSDG/gateJKjdsh.php

  • http://as9897234135.in/LKhwojehDgwegSDG/gateJKjdsh.php

  • http://as9897234135.com/LKhwojehDgwegSDG/gateJKjdsh.php

rc4.plain
rsa_pubkey.plain

Targets

    • Target
      SecuriteInfo.com.Generic.mg.22c1b894002c6ffd.12583
    • Size 723KB
    • SHA256 c91229d90c423cd5b5bf870cec714e5c956058c62f4b2036607d44f1767c50d2
    • MD5 SHA1 SHA512
    Score
    10/10
    trojanbotnetzloader

    • Suspicious use of NtCreateUserProcessOtherParentProcess

    • Zloader, Terdot, DELoader, ZeusSphinx

      Zloader is a malware strain that was initially discovered back in August 2015.

      trojanbotnetzloader

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks