General

  • Target

    cbe76b68ade1838441294ffc661c7f7329bd26c04de70e4d22c7bfb87ed3c943.zip

  • Size

    154KB

  • Sample

    210303-31tm1bn2yx

  • MD5

    fbbfc48740d02e8d8a83dcaa4d057faa

  • SHA1

    45e0be539053041d909d5a90fb109c0110e0f5e5

  • SHA256

    8590e972d263241c145b54e5954895f5cb625d7740fed2ca18866ba77e82a0b0

  • SHA512

    f6db083fe9b189f86c8a49049c65e4b3a880f70229039385c87de3446ea6a7ff2f4128f5af8af01d665e470195cd995840433aad2e608dc21b5df97031bd629f

Malware Config

Extracted

Family

zloader

Botnet

googleaktualizacija

Campaign

googleaktualizacija1

C2

https://iqowijsdakm.ru/gate.php

https://wiewjdmkfjn.ru/gate.php

https://dksaoidiakjd.su/gate.php

https://iweuiqjdakjd.su/gate.php

https://yuidskadjna.su/gate.php

https://olksmadnbdj.su/gate.php

https://odsakmdfnbs.com/gate.php

https://odsakjmdnhsaj.com/gate.php

https://odjdnhsaj.com/gate.php

https://odoishsaj.com/gate.php

rc4.plain
rsa_pubkey.plain

Targets

    • Target

      cbe76b68ade1838441294ffc661c7f7329bd26c04de70e4d22c7bfb87ed3c943.dll

    • Size

      523KB

    • MD5

      99dbb0f00c0a4a675ff967249b417903

    • SHA1

      abe0287899a323ec57bacee9edbc85ae7ec0ea30

    • SHA256

      cbe76b68ade1838441294ffc661c7f7329bd26c04de70e4d22c7bfb87ed3c943

    • SHA512

      be518a608d43148d203823f2720ec144b33f2a85e21556e128f6ab0cd079c44af23b0f97fcb6e7d172bfd11be4703b1883a6a6ed1ecc75f8631881b8c5cb76e7

    • Zloader, Terdot, DELoader, ZeusSphinx

      Zloader is a malware strain that was initially discovered back in August 2015.

MITRE ATT&CK Matrix

Tasks