General

  • Target

    microsoft_shared.tmp.zip

  • Size

    176KB

  • Sample

    201117-37n4cxqvgj

  • MD5

    e8788fc0e315decdc9d46b9932b4e90f

  • SHA1

    b1c050827b3da3ac9dc8ef4445aad7c0b7c780a3

  • SHA256

    ffa5b8db1ea6c84b4b853ddde75784108dd4ce5979c5f7240449b5746f1d7d92

  • SHA512

    516467e49eebfc28842f15fdaec89c7bb920eae562b9cd8198d90d934bf1349560711e7733c324b089c779ff2afb5e9fc1515811849954b6b9ffc64357e5591a

Malware Config

Extracted

Family

zloader

Botnet

googleaktualizacija

Campaign

googleaktualizacija2

C2

https://iqowijsdakm.com/gate.php

https://wiewjdmkfjn.com/gate.php

https://dksaoidiakjd.com/gate.php

https://iweuiqjdakjd.com/gate.php

https://yuidskadjna.com/gate.php

https://olksmadnbdj.com/gate.php

https://odsakmdfnbs.com/gate.php

https://odsakjmdnhsaj.com/gate.php

https://odjdnhsaj.com/gate.php

https://odoishsaj.com/gate.php

rc4.plain
rsa_pubkey.plain

Targets

    • Target

      microsoft_shared.tmp

    • Size

      573KB

    • MD5

      4cff80780a5018036cd2a74d35abdc05

    • SHA1

      d49602514b4e6e4a9d9c6d199c0db5ea64359256

    • SHA256

      a7f441793b5703b349ebb2509b6af1cdfdd8023d8e56f1f9a57b9d74e69bd9a9

    • SHA512

      4bf3b76e8cd4ead62b94b3fb38cd1970f3476dcfe64b3065f56c4fd6852dcd1201c134a41c96ed966e6357f7d42dfde0bf7e794a5e16c0174dfec174f06b0d81

    • Zloader, Terdot, DELoader, ZeusSphinx

      Zloader is a malware strain that was initially discovered back in August 2015.

MITRE ATT&CK Matrix

Tasks