zloader | ce842bdedc1b92083f23b2b7fe907950168225861a31320bdbada70d37215e6b

Analysis

Target

3f1f00054377124affd8fb24f61b9a670858cc44282ffcf0341907f9dbcf1d51.dll
Size

357KB
MD5

613edea279057e441e911ce8d1a4b7c8
SHA1

ec557b336ff11e216c669cc29c90a9e74771ee00
SHA256

3f1f00054377124affd8fb24f61b9a670858cc44282ffcf0341907f9dbcf1d51
SHA512

e65ad56aeb3d130d79f8870e49a5e3a6e49a0b8fd7a8cea152b70213f7073ab097d0dbd5cbf29b1f814463f92c6303030e70a5f78002bcfecc11f22a6590a5b6

Score

10^/10

Family

zloader

Botnet

googleaktualizacija

Campaign

googleaktualizacija2

https://iqowijsdakm.com/gate.php

https://wiewjdmkfjn.com/gate.php

https://dksaoidiakjd.com/gate.php

https://iweuiqjdakjd.com/gate.php

https://yuidskadjna.com/gate.php

https://olksmadnbdj.com/gate.php

https://odsakmdfnbs.com/gate.php

https://odsakjmdnhsaj.com/gate.php

https://odjdnhsaj.com/gate.php

https://odoishsaj.com/gate.php

rc4.plain

rsa_pubkey.plain

Zloader, Terdot, DELoader, ZeusSphinx
Zloader is a malware strain that was initially discovered back in August 2015.
trojan botnet zloader

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 1784 wrote to memory of 1644	1784	rundll32.exe	rundll32.exe
PID 1784 wrote to memory of 1644	1784	rundll32.exe	rundll32.exe
PID 1784 wrote to memory of 1644	1784	rundll32.exe	rundll32.exe
PID 1784 wrote to memory of 1644	1784	rundll32.exe	rundll32.exe
PID 1784 wrote to memory of 1644	1784	rundll32.exe	rundll32.exe
PID 1784 wrote to memory of 1644	1784	rundll32.exe	rundll32.exe
PID 1784 wrote to memory of 1644	1784	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\3f1f00054377124affd8fb24f61b9a670858cc44282ffcf0341907f9dbcf1d51.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1784

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\3f1f00054377124affd8fb24f61b9a670858cc44282ffcf0341907f9dbcf1d51.dll,#1
2⤵
PID:1644

memory/896-6-0x0000000000000000-mapping.dmp

Download
memory/896-8-0x0000000000090000-0x00000000000B6000-memory.dmp

Filesize
152KB

Download
memory/1624-9-0x000007FEF7510000-0x000007FEF778A000-memory.dmp

Filesize
2.5MB

Download
memory/1644-0-0x0000000000000000-mapping.dmp

Download
memory/1644-3-0x00000000760D1000-0x00000000760D3000-memory.dmp

Filesize
8KB

Download
memory/1644-4-0x00000000001B0000-0x00000000001D2000-memory.dmp

Filesize
136KB

Download
memory/1644-5-0x0000000010000000-0x0000000010026000-memory.dmp

Filesize
152KB

Download