Overview

overview

10

Static

static

SecuriteIn...65.dll

windows7_x64

10

SecuriteIn...65.dll

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    SecuriteInfo.com.Variant.Johnnie.253352.32494.27165

  • Size

    536KB

  • Sample

    201109-sn1f7nvvq2

  • MD5

    2088bda3a4d241d5b4d2769afd4f78e0

  • SHA1

    1db36876eff5b34fb0938b40dd1718dd4dfc36f0

  • SHA256

    d397fdc436fc68456b7d3887a21965139ccc4704e145fad800ffffd14851f9a6

  • SHA512

    2938b3d2fccb8d949f3847d8890fe581ad892a69963426c7be6ebac470378dcea08be81e53c2ce4aac89786f8d855be9dd26e732230f6295feea45e8770dd096

Score
10/10
zloaderbot5bot5botnetpersistencetrojan

Malware Config

Extracted

Family

zloader

Botnet

bot5

Campaign

bot5

C2

https://militanttra.at/owg.php

rc4.plain
rsa_pubkey.plain

Targets

    • Target

      SecuriteInfo.com.Variant.Johnnie.253352.32494.27165

    • Size

      536KB

    • MD5

      2088bda3a4d241d5b4d2769afd4f78e0

    • SHA1

      1db36876eff5b34fb0938b40dd1718dd4dfc36f0

    • SHA256

      d397fdc436fc68456b7d3887a21965139ccc4704e145fad800ffffd14851f9a6

    • SHA512

      2938b3d2fccb8d949f3847d8890fe581ad892a69963426c7be6ebac470378dcea08be81e53c2ce4aac89786f8d855be9dd26e732230f6295feea45e8770dd096

    Score
    10/10
    zloaderbot5bot5botnetpersistencetrojan

    • Zloader, Terdot, DELoader, ZeusSphinx

      Zloader is a malware strain that was initially discovered back in August 2015.

      trojanbotnetzloader

    • Adds Run key to start application

      persistence

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1
T1060

Privilege Escalation

Defense Evasion

Modify Registry

1
T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks