Overview

overview

10

Static

static

galadriel

windows7_x64

10

Resubmissions

02-11-2020 07:54

201102-sxyb7dzean 10

31-10-2020 02:22

201031-z87fysp3nn 1

Sharing

Copy URL
Twitter E-mail

General

  • Target

    kFQR.zip

  • Size

    186KB

  • Sample

    201102-sxyb7dzean

  • MD5

    f75aef9fb97330a6eaee4182c4b9e052

  • SHA1

    b0e23570ea1dff1ac2475f4176d49e634617b965

  • SHA256

    725241d30addb0c0c9a9146207376d14bf826fb4cf23150ae9fdc09186da86c0

  • SHA512

    f64e43044a893632b338a02c5cf9823d87a2a419a44fec013d3a7b3b0e87c9fe04582e8744b68d92a267593373300e6e93edaf2f322d059f3af9c77625a5181b

Score
10/10
zloadernut30/10botnettrojan

Malware Config

Extracted

Family

zloader

Botnet

nut

Campaign

30/10

C2

https://creditoacumuladoicms.com.br/npnegt.php

https://morgadoent.co.za/fp3jsl.php

https://access-one.us/clkgmw.php

https://amazonuniverse.in/dgxcee.php

https://ntandingsundhosmala.tk/wp-smarts.php
rc4.plain
rsa_pubkey.plain

Targets

    • Target

      kFQR.dll

    • Size

      277KB

    • MD5

      fd0a2b6c6203e4b56d8c73f6323d5d68

    • SHA1

      e87f8d9f7e768f4169355ffda625a80f0e00decb

    • SHA256

      a4711adb921498e7c74af3fd05daaa525f261e7044d457e905dad66767e5b8b4

    • SHA512

      85bc1fd3fba441bbb67d6b75c3f058f2acec396299a012bc0c4ba5c1a5a105c712c54f258a58dc5ef2ef7789a58227d4ce99d14f53ceaf5c3cebdd44fe930c3a

    Score
    10/10
    zloadernut30/10botnettrojan

    • Suspicious use of NtCreateUserProcessOtherParentProcess

    • Zloader, Terdot, DELoader, ZeusSphinx

      Zloader is a malware strain that was initially discovered back in August 2015.

      trojanbotnetzloader

    • Blacklisted process makes network request

    • Suspicious use of SetThreadContext

    behavioral1

MITRE ATT&CK Matrix

Tasks