zloader | cbf6848b72b118e090953347982de71cfe1510dfdc4affdb1ee4d5d62af428d6

Analysis

Target

microsoft_shared.tmp.dll
Size

574KB
MD5

d657bd947fecdb34e989349b6f72daac
SHA1

36d0b1172673405a7d144a1a34841e794cea9e5a
SHA256

cbf6848b72b118e090953347982de71cfe1510dfdc4affdb1ee4d5d62af428d6
SHA512

02ce2ee305c8ec66abc66cd6a5dde4d9edd863a19c800e667b5db746b3f0b8ca0104fd372095dfdcc696a8960c58c594261265461c9caca543501f8c02171e4f

Score

10^/10

Family

zloader

Botnet

personal

Campaign

personal

https://iqowijsdakm.com/gate.php

https://wiewjdmkfjn.com/gate.php

https://dksaoidiakjd.com/gate.php

https://iweuiqjdakjd.com/gate.php

https://yuidskadjna.com/gate.php

https://olksmadnbdj.com/gate.php

https://odsakmdfnbs.com/gate.php

https://odsakjmdnhsaj.com/gate.php

https://odjdnhsaj.com/gate.php

https://odoishsaj.com/gate.php

rc4.plain

rsa_pubkey.plain

Zloader, Terdot, DELoader, ZeusSphinx
Zloader is a malware strain that was initially discovered back in August 2015.
trojan botnet zloader

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 4772 wrote to memory of 4816	4772	rundll32.exe	rundll32.exe
PID 4772 wrote to memory of 4816	4772	rundll32.exe	rundll32.exe
PID 4772 wrote to memory of 4816	4772	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\microsoft_shared.tmp.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4772

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\microsoft_shared.tmp.dll,#1
2⤵
PID:4816

memory/420-3-0x0000000000AD0000-0x0000000000AF6000-memory.dmp

Filesize
152KB

Download
memory/420-4-0x0000000000000000-mapping.dmp

Download
memory/4816-2-0x0000000000000000-mapping.dmp

Download