Overview

overview

10

Static

static

9

senate.m4a.dll

windows7_x64

10

senate.m4a.dll

windows10_x64

1

Sharing

Copy URL Twitter E-mail

General

  • Target
    senate.m4a
  • Size 575KB
  • Sample201109-x98lp536tn
  • SHA256 3bc843b534c96a38ab8f4b785f902f70dc8ebd48164aa0870562da285c49a9ec
  • MD5 SHA1 SHA512
Score
10/10
zloaderspx139spx139botnetcryptonepackertrojan

Malware Config

Extracted

Family

  • zloader

Botnet

  • spx139

Campaign

  • spx139

C2

  • https://xeemoquo.top/treusparq.php

  • https://leeephee.top/treusparq.php

  • https://withifceale.top/treusparq.php

  • https://wpsnoum.pw/treusparq.php

  • https://wsaexdig.pw/treusparq.php

rc4.plain
rsa_pubkey.plain

Targets

    • Target
      senate.m4a
    • Size 575KB
    • SHA256 3bc843b534c96a38ab8f4b785f902f70dc8ebd48164aa0870562da285c49a9ec
    • MD5 SHA1 SHA512
    Score
    10/10
    zloaderspx139spx139botnettrojan

    • Zloader, Terdot, DELoader, ZeusSphinx

      Zloader is a malware strain that was initially discovered back in August 2015.

      trojanbotnetzloader

    • Blacklisted process makes network request

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks