Overview

overview

10

Static

static

d9296a8ed1...99.dll

windows7_x64

10

d9296a8ed1...99.dll

windows10_x64

1

Resubmissions

15-11-2023 15:23

231115-ssstfsbf48 10

26-10-2020 10:00

201026-ltfyhgt87a 10

26-10-2020 09:57

201026-g5lkjjzlws 10

25-10-2020 21:42

201025-xtgchbgbbn 1

Sharing

Copy URL
Twitter E-mail

General

  • Target

    d9296a8ed1105c0e7908434a76681299

  • Size

    615KB

  • Sample

    201026-ltfyhgt87a

  • MD5

    d9296a8ed1105c0e7908434a76681299

  • SHA1

    593bd26bdc829c7633096d016012ceda1183d3f9

  • SHA256

    783dace9ccb4090a09e4f3a229eeeef14246709e25175b0ce0fe749cd736de55

  • SHA512

    18cdfff6d26cca2e09513def3800bab8046c1925ab4aff54cd18d6ea604f5f7315a833acbb7c51f9afdb7ebeca4ee6c9b79a0d315f8c23c12fbb4df83407c52d

Score
10/10
zloaderspx138spx138botnettrojan

Malware Config

Extracted

Family

zloader

Botnet

spx138

Campaign

spx138

C2

https://xeemoquo.top/treusparq.php

https://leeephee.top/treusparq.php

https://withifceale.top/treusparq.php

https://wpsnoum.pw/treusparq.php

https://wsaexdig.pw/treusparq.php
rc4.plain
rsa_pubkey.plain

Targets

    • Target

      d9296a8ed1105c0e7908434a76681299

    • Size

      615KB

    • MD5

      d9296a8ed1105c0e7908434a76681299

    • SHA1

      593bd26bdc829c7633096d016012ceda1183d3f9

    • SHA256

      783dace9ccb4090a09e4f3a229eeeef14246709e25175b0ce0fe749cd736de55

    • SHA512

      18cdfff6d26cca2e09513def3800bab8046c1925ab4aff54cd18d6ea604f5f7315a833acbb7c51f9afdb7ebeca4ee6c9b79a0d315f8c23c12fbb4df83407c52d

    Score
    10/10
    trojanbotnetzloader

    • Zloader, Terdot, DELoader, ZeusSphinx

      Zloader is a malware strain that was initially discovered back in August 2015.

      trojanbotnetzloader

    • Blacklisted process makes network request

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks