Overview

overview

10

Static

static

SecuriteIn...76.dll

windows7_x64

10

SecuriteIn...76.dll

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    SecuriteInfo.com.Variant.Johnnie.253352.23036.17576

  • Size

    536KB

  • Sample

    201109-dbdsrexglx

  • MD5

    2fac38dc801716d730a94667f1e46338

  • SHA1

    2a7d8e1b1f3a4bd51da44191edc1932361272182

  • SHA256

    d94b57307f3b68e57f1cf34e4aaa0794a6d0b4c551d05f6d1a2f0d3b45625177

  • SHA512

    5c718fc7c86563e7b931d60fb1be52f3d3db75de6a978268a450e5025473d4ab23f9d800931eed1992b43cfce1b825739daf46b6ff2c7f425a285ff5efa17190

Score
10/10
zloaderbot5bot5botnetpersistencetrojan

Malware Config

Extracted

Family

zloader

Botnet

bot5

Campaign

bot5

C2

https://militanttra.at/owg.php

rc4.plain
rsa_pubkey.plain

Targets

    • Target

      SecuriteInfo.com.Variant.Johnnie.253352.23036.17576

    • Size

      536KB

    • MD5

      2fac38dc801716d730a94667f1e46338

    • SHA1

      2a7d8e1b1f3a4bd51da44191edc1932361272182

    • SHA256

      d94b57307f3b68e57f1cf34e4aaa0794a6d0b4c551d05f6d1a2f0d3b45625177

    • SHA512

      5c718fc7c86563e7b931d60fb1be52f3d3db75de6a978268a450e5025473d4ab23f9d800931eed1992b43cfce1b825739daf46b6ff2c7f425a285ff5efa17190

    Score
    10/10
    zloaderbot5bot5botnetpersistencetrojan

    • Zloader, Terdot, DELoader, ZeusSphinx

      Zloader is a malware strain that was initially discovered back in August 2015.

      trojanbotnetzloader

    • Adds Run key to start application

      persistence

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1
T1060

Privilege Escalation

Defense Evasion

Modify Registry

1
T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks