zloader | c9421f3337c485aee66f75a1015f76b8b772fc144d7e56b11c5afb9f801aeb88

Analysis

Target

84e360a829386b13dbf487803bc7b8a04f68b9b743ebfa3c9eea76abe00773d4.dll
Size

652KB
MD5

142cf09ef1d30a422dbf43803e7c1517
SHA1

f1d680faed22c11ffcc8d103bbed2794ca1089f0
SHA256

84e360a829386b13dbf487803bc7b8a04f68b9b743ebfa3c9eea76abe00773d4
SHA512

75700b1bef08eedc36cfcf93449e3575140d94dca96108d663252debbe48303ab97dc2b0b2b4a1c5139f857fb307b54807630c524b31adfa11b53d9820ebd183

Score

10^/10

Family

zloader

Botnet

nut

Campaign

26/10

https://kare.academy/wl9nfl.php

https://skal.tk/a0qqpr.php

https://casascala.isoladelba.it/1lhdcb.php

https://tamilgreets.com/0vjkrn.php

https://ahoracallao.com/kzqlgx.php

https://shbiolabs.com/gkqm9o.php

https://bmavan.com/qshecj.php

https://barsoleillevant.fr/czdhxu.php

https://innovabusiness.cv/assly0.php

https://mevededustderin.tk/wp-smarts.php

rc4.plain

rsa_pubkey.plain

Zloader, Terdot, DELoader, ZeusSphinx
Zloader is a malware strain that was initially discovered back in August 2015.
trojan botnet zloader

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 1036 wrote to memory of 1228	1036	rundll32.exe	rundll32.exe
PID 1036 wrote to memory of 1228	1036	rundll32.exe	rundll32.exe
PID 1036 wrote to memory of 1228	1036	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\84e360a829386b13dbf487803bc7b8a04f68b9b743ebfa3c9eea76abe00773d4.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1036

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\84e360a829386b13dbf487803bc7b8a04f68b9b743ebfa3c9eea76abe00773d4.dll,#1
2⤵
PID:1228

memory/1228-0-0x0000000000000000-mapping.dmp

Download
memory/3108-1-0x0000000000460000-0x0000000000486000-memory.dmp

Filesize
152KB

Download
memory/3108-2-0x0000000000000000-mapping.dmp

Download