Overview

overview

10

Static

static

server.dll

windows7_x64

10

server.dll

windows10_x64

8

Sharing

Copy URL
Twitter E-mail

General

  • Target

    server.dll

  • Size

    336KB

  • Sample

    210303-jn6l7gp79n

  • MD5

    f6f15b210088e340c2f223ffb6894d12

  • SHA1

    9edb31c56cc8befe1e41924f53cb96f9962c2328

  • SHA256

    7a0e70c85d65c95a7c98a7f14eaaa9b9f59795add4abb6a09ff2d75fbf947e80

  • SHA512

    b5b20f1e8f943bef8777b94c88d85a535c27563821bd62f68dace9b5e4842246a21eab33aa52f33eeb218bb098bc2197fc92eba058744834414879b22e360d53

Score
10/10
zloadernut01/03botnettrojan

Malware Config

Extracted

Family

zloader

Botnet

nut

Campaign

01/03

C2

https://bentalks.co.ke/post.php

https://karhandlafarm.com/post.php

https://www.moinamakeup.com/post.php

https://miramaminerals.com/post.php

https://fermin.pe/post.php

https://talk2point.com/post.php

https://enpikilenlya.gq/post.php
rc4.plain
rsa_pubkey.plain

Targets

    • Target

      server.dll

    • Size

      336KB

    • MD5

      f6f15b210088e340c2f223ffb6894d12

    • SHA1

      9edb31c56cc8befe1e41924f53cb96f9962c2328

    • SHA256

      7a0e70c85d65c95a7c98a7f14eaaa9b9f59795add4abb6a09ff2d75fbf947e80

    • SHA512

      b5b20f1e8f943bef8777b94c88d85a535c27563821bd62f68dace9b5e4842246a21eab33aa52f33eeb218bb098bc2197fc92eba058744834414879b22e360d53

    Score
    10/10
    zloadernut01/03botnettrojan

    • Zloader, Terdot, DELoader, ZeusSphinx

      Zloader is a malware strain that was initially discovered back in August 2015.

      trojanbotnetzloader

    • Blocklisted process makes network request

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks