zloader | b3de1118d6c87e6a1dfb9cc39e01073c8dc7af9057a60e03d7f168182700dc19

Analysis

Target

bd8fb3c8abf97cdd741af7e8fd921a3b5d4a1efde9490933e405baa8f5226101.dll
Size

357KB
MD5

9fc59f68d528d95e13a706e6f5c8cc9d
SHA1

64b3489a39907d5a8adc8fabf18afeb6f573a97e
SHA256

bd8fb3c8abf97cdd741af7e8fd921a3b5d4a1efde9490933e405baa8f5226101
SHA512

a1e5df2e959ced5b4d16bfbbef512e2129e3d82e4fd799ad6e24728a29903617b54a1c7af322215a5899ab03cd51f17eaa8e57a27644398c8a08e42c42cf3712

Score

10^/10

Family

zloader

Botnet

googleaktualizacija

Campaign

googleaktualizacija2

https://iqowijsdakm.com/gate.php

https://wiewjdmkfjn.com/gate.php

https://dksaoidiakjd.com/gate.php

https://iweuiqjdakjd.com/gate.php

https://yuidskadjna.com/gate.php

https://olksmadnbdj.com/gate.php

https://odsakmdfnbs.com/gate.php

https://odsakjmdnhsaj.com/gate.php

https://odjdnhsaj.com/gate.php

https://odoishsaj.com/gate.php

rc4.plain

rsa_pubkey.plain

Zloader, Terdot, DELoader, ZeusSphinx
Zloader is a malware strain that was initially discovered back in August 2015.
trojan botnet zloader

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 1940 wrote to memory of 1460	1940	rundll32.exe	rundll32.exe
PID 1940 wrote to memory of 1460	1940	rundll32.exe	rundll32.exe
PID 1940 wrote to memory of 1460	1940	rundll32.exe	rundll32.exe
PID 1940 wrote to memory of 1460	1940	rundll32.exe	rundll32.exe
PID 1940 wrote to memory of 1460	1940	rundll32.exe	rundll32.exe
PID 1940 wrote to memory of 1460	1940	rundll32.exe	rundll32.exe
PID 1940 wrote to memory of 1460	1940	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\bd8fb3c8abf97cdd741af7e8fd921a3b5d4a1efde9490933e405baa8f5226101.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1940

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\bd8fb3c8abf97cdd741af7e8fd921a3b5d4a1efde9490933e405baa8f5226101.dll,#1
2⤵
PID:1460

memory/888-9-0x000007FEF7120000-0x000007FEF739A000-memory.dmp

Filesize
2.5MB

Download
memory/1460-2-0x0000000000000000-mapping.dmp

Download
memory/1460-3-0x00000000759F1000-0x00000000759F3000-memory.dmp

Filesize
8KB

Download
memory/1460-4-0x0000000000200000-0x0000000000222000-memory.dmp

Filesize
136KB

Download
memory/1460-5-0x0000000010000000-0x0000000010026000-memory.dmp

Filesize
152KB

Download
memory/1632-6-0x0000000000000000-mapping.dmp

Download
memory/1632-8-0x00000000000D0000-0x00000000000F6000-memory.dmp

Filesize
152KB

Download