Overview

overview

10

Static

static

galadriel

windows7_x64

10

Resubmissions

31-10-2020 17:30

201031-3hg5q2lj72 10

31-10-2020 17:22

201031-8cwbaek9f6 10

31-10-2020 00:24

201031-y7l54dz7se 1

Sharing

Copy URL
Twitter E-mail

General

  • Target

    kFQR.dll

  • Size

    277KB

  • Sample

    201031-8cwbaek9f6

  • MD5

    fd0a2b6c6203e4b56d8c73f6323d5d68

  • SHA1

    e87f8d9f7e768f4169355ffda625a80f0e00decb

  • SHA256

    a4711adb921498e7c74af3fd05daaa525f261e7044d457e905dad66767e5b8b4

  • SHA512

    85bc1fd3fba441bbb67d6b75c3f058f2acec396299a012bc0c4ba5c1a5a105c712c54f258a58dc5ef2ef7789a58227d4ce99d14f53ceaf5c3cebdd44fe930c3a

Score
10/10
zloadernut30/10botnetpersistencespywaretrojan

Malware Config

Extracted

Family

zloader

Botnet

nut

Campaign

30/10

C2

https://creditoacumuladoicms.com.br/npnegt.php

https://morgadoent.co.za/fp3jsl.php

https://access-one.us/clkgmw.php

https://amazonuniverse.in/dgxcee.php

https://ntandingsundhosmala.tk/wp-smarts.php
rc4.plain
rsa_pubkey.plain

Targets

    • Target

      kFQR.dll

    • Size

      277KB

    • MD5

      fd0a2b6c6203e4b56d8c73f6323d5d68

    • SHA1

      e87f8d9f7e768f4169355ffda625a80f0e00decb

    • SHA256

      a4711adb921498e7c74af3fd05daaa525f261e7044d457e905dad66767e5b8b4

    • SHA512

      85bc1fd3fba441bbb67d6b75c3f058f2acec396299a012bc0c4ba5c1a5a105c712c54f258a58dc5ef2ef7789a58227d4ce99d14f53ceaf5c3cebdd44fe930c3a

    Score
    10/10
    zloadernut30/10botnetpersistencespywaretrojan

    • Suspicious use of NtCreateUserProcessOtherParentProcess

    • Zloader, Terdot, DELoader, ZeusSphinx

      Zloader is a malware strain that was initially discovered back in August 2015.

      trojanbotnetzloader

    • Blacklisted process makes network request

    • Executes dropped EXE

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spyware

    • Accesses cryptocurrency files/wallets, possible credential harvesting

      spyware

    • Modifies service

      persistence

    • Suspicious use of SetThreadContext

    behavioral1

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Command-Line Interface

1
T1059

Persistence

Modify Existing Service

1
T1031

Privilege Escalation

Defense Evasion

Modify Registry

1
T1112

Credential Access

Credentials in Files

2
T1081

Discovery

Remote System Discovery

1
T1018

System Information Discovery

1
T1082

Lateral Movement

Collection

Data from Local System

2
T1005

Exfiltration

Command and Control

Impact

Tasks