Overview

overview

10

Static

static

Paynature.dll

windows7_x64

10

Paynature.dll

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    Paynature.zip

  • Size

    245KB

  • Sample

    201102-sbmqyxwwzs

  • MD5

    33510310ee6070620c2a32deac562cfe

  • SHA1

    0f359f3654b4ceceb27c57b028fae27864ca3aab

  • SHA256

    ab0abc459303dc36461a5766d79add75a98bfd74d9ec3865f694ddbf35185645

  • SHA512

    e31b63b617002bf162986062d69fc10839b98d4d7e10a87693284eb0e1ee88313feaff9b1d0b9096d8c8a3048611c3671dc324f2e5b16ec0b9200baa1a842973

Score
10/10
zloaderbotnetpersistencetrojan

Malware Config

Targets

    • Target

      Paynature.dll

    • Size

      338KB

    • MD5

      62d565051f3cae6d6bc8971420bec819

    • SHA1

      b6c0f532108a3b392e9d8c1b0cfbf85cf8aa8fb3

    • SHA256

      f1bdd2bcbaf40bb99224fa293edc1581fd124da63c035657918877901d79bed8

    • SHA512

      c1401aeb4788ff39a501529ab3cd55223570404657be98c137326d76f7a23e5bf6dbb1faefd609519819c509ffcfd4d47f06c09afacad460485fbda9eb87d9ff

    Score
    10/10
    zloaderbotnetpersistencetrojan

    • Zloader, Terdot, DELoader, ZeusSphinx

      Zloader is a malware strain that was initially discovered back in August 2015.

      trojanbotnetzloader

    • Adds Run key to start application

      persistence

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1
T1060

Privilege Escalation

Defense Evasion

Modify Registry

1
T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks