Extracted

Extracted

• • Target
    case (4374).xls
  • Size 153KB
  • SHA256 28ce05e2ebeec4b1754d5ffcfe3e4486e8e9201f375da899aef2ea6d3b02dd60
  • MD5 2bc3acec77fec6f8a78b77c5efb5c5ee
  • SHA1 e4b3f2149b6d7b8ad912b127bd8ad9fb0eb0246b
  • SHA512 a05914b1504997c5e52468987a20b9f2b877d665f510d985b0aa9798c936252d39986efd3e49f929c383550db1a200ba2c66c049e6340ef391d922553e828854
  • MD5 SHA1 SHA512

  Score

  10^/10

  zloaderkev26/01botnetransomwaretrojan

  • Process spawned unexpected child process

    This typically indicates the parent process was compromised via an exploit or macro.

  • Zloader, Terdot, DELoader, ZeusSphinx

    Zloader is a malware strain that was initially discovered back in August 2015.

    trojanbotnetzloader

  • Blocklisted process makes network request

  • Loads dropped DLL

  • Enumerates physical storage devices

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

    ransomware

  • Suspicious use of SetThreadContext

  behavioral1behavioral2