zloader | 907a644328011c9d50c192e06ef14bf5e6be5f4c3f4dddacfba7ebb8d22d0738

Analysis

Target

89d2e280a893091f2f60099cbaa616ed.dll
Size

776KB
MD5

89d2e280a893091f2f60099cbaa616ed
SHA1

cca6be054d570ae2b5ebc527b5ceb6e23ac15504
SHA256

907a644328011c9d50c192e06ef14bf5e6be5f4c3f4dddacfba7ebb8d22d0738
SHA512

6f73c20829b42e6a6064cdd97134af8edd78077f175eabf7ed28ff07eafad0c2fd241ec93a3d11075b716e2606b3f8aba40de6f37b83c39d9de3596c6c07e80f

Score

10^/10

Family

zloader

Botnet

googleaktualizacija

Campaign

googleaktualizacija2

https://iqowijsdakm.com/gate.php

https://wiewjdmkfjn.com/gate.php

https://dksaoidiakjd.com/gate.php

https://iweuiqjdakjd.com/gate.php

https://yuidskadjna.com/gate.php

https://olksmadnbdj.com/gate.php

https://odsakmdfnbs.com/gate.php

https://odsakjmdnhsaj.com/gate.php

https://odjdnhsaj.com/gate.php

https://odoishsaj.com/gate.php

rc4.plain

rsa_pubkey.plain

Zloader, Terdot, DELoader, ZeusSphinx
Zloader is a malware strain that was initially discovered back in August 2015.
trojan botnet zloader

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 580 wrote to memory of 1152	580	rundll32.exe	rundll32.exe
PID 580 wrote to memory of 1152	580	rundll32.exe	rundll32.exe
PID 580 wrote to memory of 1152	580	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\89d2e280a893091f2f60099cbaa616ed.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:580

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\89d2e280a893091f2f60099cbaa616ed.dll,#1
2⤵
PID:1152

memory/336-5-0x0000000000000000-mapping.dmp

Download
memory/336-6-0x0000000000B20000-0x0000000000B46000-memory.dmp

Filesize
152KB

Download
memory/1152-2-0x0000000000000000-mapping.dmp

Download
memory/1152-3-0x00000000047C0000-0x000000000486D000-memory.dmp

Filesize
692KB

Download
memory/1152-4-0x0000000000400000-0x0000000000426000-memory.dmp

Filesize
152KB

Download