zloader | 725241d30addb0c0c9a9146207376d14bf826fb4cf23150ae9fdc09186da86c0

Resubmissions

02-11-2020 07:53

31-10-2020 02:04

Target

kFQR.dll
Size

277KB
MD5

fd0a2b6c6203e4b56d8c73f6323d5d68
SHA1

e87f8d9f7e768f4169355ffda625a80f0e00decb
SHA256

a4711adb921498e7c74af3fd05daaa525f261e7044d457e905dad66767e5b8b4
SHA512

85bc1fd3fba441bbb67d6b75c3f058f2acec396299a012bc0c4ba5c1a5a105c712c54f258a58dc5ef2ef7789a58227d4ce99d14f53ceaf5c3cebdd44fe930c3a

Score

10^/10

Family

zloader

Botnet

nut

Campaign

30/10

https://creditoacumuladoicms.com.br/npnegt.php

https://morgadoent.co.za/fp3jsl.php

https://access-one.us/clkgmw.php

https://amazonuniverse.in/dgxcee.php

https://ntandingsundhosmala.tk/wp-smarts.php

rc4.plain

rsa_pubkey.plain

Zloader, Terdot, DELoader, ZeusSphinx
Zloader is a malware strain that was initially discovered back in August 2015.
trojan botnet zloader

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 1040 wrote to memory of 1844	1040	rundll32.exe	rundll32.exe
PID 1040 wrote to memory of 1844	1040	rundll32.exe	rundll32.exe
PID 1040 wrote to memory of 1844	1040	rundll32.exe	rundll32.exe
PID 1040 wrote to memory of 1844	1040	rundll32.exe	rundll32.exe
PID 1040 wrote to memory of 1844	1040	rundll32.exe	rundll32.exe
PID 1040 wrote to memory of 1844	1040	rundll32.exe	rundll32.exe
PID 1040 wrote to memory of 1844	1040	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\kFQR.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1040

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\kFQR.dll,#1
2⤵
PID:1844

memory/524-5-0x000007FEF7880000-0x000007FEF7AFA000-memory.dmp

Filesize
2.5MB

Download
memory/1624-1-0x0000000000090000-0x00000000000B6000-memory.dmp

Filesize
152KB

Download
memory/1624-2-0x00000000000C0000-0x00000000000C1000-memory.dmp

Filesize
4KB

Download
memory/1624-3-0x0000000000090000-0x00000000000B6000-memory.dmp

Filesize
152KB

Download
memory/1624-4-0x0000000000000000-mapping.dmp

Download
memory/1844-0-0x0000000000000000-mapping.dmp

Download