Overview

overview

10

Static

static

2020-11-27...in.dll

windows7_x64

10

2020-11-27...in.dll

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    2020-11-27-ZLoader-DLL-example-02.bin

  • Size

    285KB

  • Sample

    201127-rxzlgz38nx

  • MD5

    a14d7a30ec304ce96f88347b25cbb668

  • SHA1

    092a7a2f5509b92adacacb3b9215e2e61ba633fc

  • SHA256

    b513c6fc32ea4666e3be5c62d50336db003f75de5344450c8e4a2d88b8911c06

  • SHA512

    939c778efa7ec498b4b8b3d3e0ef9e1ab2f71845ed9a5513673290240fd0ab88b378e5d0ac682da639c2809a070aa538f8f0da762d8d41e584ea2ef46cc64589

Score
10/10
zloadervek27/11botnettrojan

Malware Config

Extracted

Family

zloader

Botnet

vek

Campaign

27/11

C2

https://hac3r.com/wp-punch.php

https://womtools.com/wp-punch.php

https://valitec.co/wp-punch.php

https://empresascreciendobien.com/server.php

https://smartat.co/error.php

https://teamearenttopdiaty.ga/wp-smarts.php
rc4.plain
rsa_pubkey.plain

Targets

    • Target

      2020-11-27-ZLoader-DLL-example-02.bin

    • Size

      285KB

    • MD5

      a14d7a30ec304ce96f88347b25cbb668

    • SHA1

      092a7a2f5509b92adacacb3b9215e2e61ba633fc

    • SHA256

      b513c6fc32ea4666e3be5c62d50336db003f75de5344450c8e4a2d88b8911c06

    • SHA512

      939c778efa7ec498b4b8b3d3e0ef9e1ab2f71845ed9a5513673290240fd0ab88b378e5d0ac682da639c2809a070aa538f8f0da762d8d41e584ea2ef46cc64589

    Score
    10/10
    zloadervek27/11botnettrojan

    • Zloader, Terdot, DELoader, ZeusSphinx

      Zloader is a malware strain that was initially discovered back in August 2015.

      trojanbotnetzloader

    • Blacklisted process makes network request

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks