Overview

overview

10

Static

static

1255.dll

windows7_x64

10

1255.dll

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    1255.zip

  • Size

    184KB

  • Sample

    201102-t38ga6lpde

  • MD5

    7f466a68e9425fc989a164a4f1e8239a

  • SHA1

    c2afb9f3f8ff438818bdce9938dd0bf436d8c8da

  • SHA256

    cfc1944acff90935f9c7e42939d6384dfeaac9c9e481314b97b2033238d9c83f

  • SHA512

    b2ae2c8703697e7438cdb7396d70c9a384cd68f040d94dfae5c861264a1a6548e01eb104d47775ed9381e8a31667eacbc7bf9a109755fb32414d6f4aeddd8665

Score
10/10
zloaderdllobnovacookiesfixbotnetpersistencetrojan

Malware Config

Extracted

Family

zloader

Botnet

DLLobnova

Campaign

cookiesfix

C2

https://fdsjfjdsfjdsdsjajjs.com/gate.php

https://idisaudhasdhasdj.com/gate.php

https://dsjdjsjdsadhasdas.com/gate.php

https://dsdjfhdsufudhjas.com/gate.php

https://dsdjfhdsufudhjas.info/gate.php

https://fdsjfjdsfjdsdsjajjs.info/gate.php

https://idisaudhasdhasdj.info/gate.php

https://dsdjfhdsufudhjas.pro/gate.php

https://dsdjfhd9ddksaas.pro/gate.php
rc4.plain

Targets

    • Target

      1255.dll

    • Size

      314KB

    • MD5

      d31b05ee7a806f3ffa827a4586478e92

    • SHA1

      ec614f83758247b25d5699013a8dd7bf7f597bf2

    • SHA256

      10fef4095658c0e9ace83a11bf287add9a36d30fb4b037fc89f3e32388e6f652

    • SHA512

      559a69b92ccda30a79f33e0b967c269c5ce8d377a648514bb45af86c909c5c784a461da8c1e940a06f5cc2d3e7020b97f98c71da6cb886a2d308102814a8f177

    Score
    10/10
    zloaderdllobnovacookiesfixbotnetpersistencetrojan

    • Zloader, Terdot, DELoader, ZeusSphinx

      Zloader is a malware strain that was initially discovered back in August 2015.

      trojanbotnetzloader

    • Blacklisted process makes network request

    • Adds Run key to start application

      persistence

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1
T1060

Privilege Escalation

Defense Evasion

Modify Registry

1
T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks