Overview

overview

10

Static

static

b513c6fc32...06.dll

windows7_x64

10

b513c6fc32...06.dll

windows10_x64

8

Sharing

Copy URL
Twitter E-mail

General

  • Target

    b513c6fc32ea4666e3be5c62d50336db003f75de5344450c8e4a2d88b8911c06.zip

  • Size

    198KB

  • Sample

    210303-8r6dhcmw1j

  • MD5

    81f1509bb242d52ab0f988c617a4b48f

  • SHA1

    510e5f71cc1b785d8da0ca6f6d836251a8135eaa

  • SHA256

    d0981afbb7946eba293454df2bc7c48d48729c726d477465dbc61aedf6943d68

  • SHA512

    b3915f4d7c3a41324923d25730d58c585b1cd1084b0c21f9ccbe7f717ac8440a2ee59745f4da239e0654558c8577becae7757d742e6f883afca47c278b0fbd82

Score
10/10
zloadervek27/11botnettrojan

Malware Config

Extracted

Family

zloader

Botnet

vek

Campaign

27/11

C2

https://hac3r.com/wp-punch.php

https://womtools.com/wp-punch.php

https://valitec.co/wp-punch.php

https://empresascreciendobien.com/server.php

https://smartat.co/error.php

https://teamearenttopdiaty.ga/wp-smarts.php
rc4.plain
rsa_pubkey.plain

Targets

    • Target

      b513c6fc32ea4666e3be5c62d50336db003f75de5344450c8e4a2d88b8911c06.dll

    • Size

      285KB

    • MD5

      a14d7a30ec304ce96f88347b25cbb668

    • SHA1

      092a7a2f5509b92adacacb3b9215e2e61ba633fc

    • SHA256

      b513c6fc32ea4666e3be5c62d50336db003f75de5344450c8e4a2d88b8911c06

    • SHA512

      939c778efa7ec498b4b8b3d3e0ef9e1ab2f71845ed9a5513673290240fd0ab88b378e5d0ac682da639c2809a070aa538f8f0da762d8d41e584ea2ef46cc64589

    Score
    10/10
    zloadervek27/11botnettrojan

    • Zloader, Terdot, DELoader, ZeusSphinx

      Zloader is a malware strain that was initially discovered back in August 2015.

      trojanbotnetzloader

    • Blocklisted process makes network request

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks