Overview

overview

10

Static

static

dws.dll

windows7_x64

10

dws.dll

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    dws.dll

  • Size

    664KB

  • Sample

    201109-b6wl3kgmsa

  • MD5

    b5009fa4759ad978c438232d613c8ba0

  • SHA1

    e8980445b432b6bd8d73c6cc5c1353966b37d114

  • SHA256

    0eb287052bad63c28c2ddb52722b87a40331cb41806e494cd4d83c8b409c6178

  • SHA512

    67c1dda03ce6a495a30749843e207e067ee5a372714944f346f78df61cc04ef7f95fe2cfb0077653c695112dac7eccd54b6c93da447cbffb07577333afb384f3

Score
10/10
zloaderbot5bot5botnetpersistencetrojan

Malware Config

Extracted

Family

zloader

Botnet

bot5

Campaign

bot5

C2

https://militanttra.at/owg.php

rc4.plain
rsa_pubkey.plain

Targets

    • Target

      dws.dll

    • Size

      664KB

    • MD5

      b5009fa4759ad978c438232d613c8ba0

    • SHA1

      e8980445b432b6bd8d73c6cc5c1353966b37d114

    • SHA256

      0eb287052bad63c28c2ddb52722b87a40331cb41806e494cd4d83c8b409c6178

    • SHA512

      67c1dda03ce6a495a30749843e207e067ee5a372714944f346f78df61cc04ef7f95fe2cfb0077653c695112dac7eccd54b6c93da447cbffb07577333afb384f3

    Score
    10/10
    zloaderbot5bot5botnetpersistencetrojan

    • Zloader, Terdot, DELoader, ZeusSphinx

      Zloader is a malware strain that was initially discovered back in August 2015.

      trojanbotnetzloader

    • Adds Run key to start application

      persistence

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1
T1060

Privilege Escalation

Defense Evasion

Modify Registry

1
T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks