General

  • Target

    2b5e50bc3077610128051bc3e657c3f0e331fb8fed2559c6596911890ea866ba

  • Size

    183KB

  • Sample

    201118-5hj5t5yd5x

  • MD5

    6d2864f9d3349fc4292884e7baab4bcc

  • SHA1

    b4e7df23ccd50f4d136f66e62d56815eab09e720

  • SHA256

    2b5e50bc3077610128051bc3e657c3f0e331fb8fed2559c6596911890ea866ba

  • SHA512

    dcfc50105df4ea00add6dc3d121baa3ff93180a0be71e444e89e3a8249d1fd2103eb34aa61aa57ada45c5a86ed5783a67e10f21eeb9dda802a49f627aaa0cec0

Malware Config

Extracted

Family

zloader

Botnet

07/04

C2

https://xyajbocpggsr.site/wp-config.php

https://ooygvpxrb.pw/wp-config.php

rc4.plain

Targets

    • Target

      2b5e50bc3077610128051bc3e657c3f0e331fb8fed2559c6596911890ea866ba

    • Size

      183KB

    • MD5

      6d2864f9d3349fc4292884e7baab4bcc

    • SHA1

      b4e7df23ccd50f4d136f66e62d56815eab09e720

    • SHA256

      2b5e50bc3077610128051bc3e657c3f0e331fb8fed2559c6596911890ea866ba

    • SHA512

      dcfc50105df4ea00add6dc3d121baa3ff93180a0be71e444e89e3a8249d1fd2103eb34aa61aa57ada45c5a86ed5783a67e10f21eeb9dda802a49f627aaa0cec0

    • Zloader, Terdot, DELoader, ZeusSphinx

      Zloader is a malware strain that was initially discovered back in August 2015.

    • Suspicious use of SetThreadContext

MITRE ATT&CK Matrix

Collection

    Command and Control

      Credential Access

        Defense Evasion

          Discovery

            Execution

              Exfiltration

                Impact

                  Initial Access

                    Lateral Movement

                      Persistence

                        Privilege Escalation

                          Tasks