General

  • Target

    a7f441793b5703b349ebb2509b6af1cdfdd8023d8e56f1f9a57b9d74e69bd9a9.zip

  • Size

    175KB

  • Sample

    210303-ktsg6kes1n

  • MD5

    51a70bb41add233befb0f042d601dc55

  • SHA1

    4354b98caa312758d5eb54a1271f267ef5dec84a

  • SHA256

    4b5116af7e8e0238bdf5466f5a52de30f03685f9ef1761bd460f1702ff364464

  • SHA512

    9bafe2e69d9b349bf10fe7e0df3b18125599d4c0b3f642920f3f54c1f59283010c2973b0a0bcc7d1f56d72063f883522c11f589b93355cd0d82fe533c3955ceb

Malware Config

Extracted

Family

zloader

Botnet

googleaktualizacija

Campaign

googleaktualizacija2

C2

https://iqowijsdakm.com/gate.php

https://wiewjdmkfjn.com/gate.php

https://dksaoidiakjd.com/gate.php

https://iweuiqjdakjd.com/gate.php

https://yuidskadjna.com/gate.php

https://olksmadnbdj.com/gate.php

https://odsakmdfnbs.com/gate.php

https://odsakjmdnhsaj.com/gate.php

https://odjdnhsaj.com/gate.php

https://odoishsaj.com/gate.php

rc4.plain
rsa_pubkey.plain

Targets

    • Target

      a7f441793b5703b349ebb2509b6af1cdfdd8023d8e56f1f9a57b9d74e69bd9a9.dll

    • Size

      573KB

    • MD5

      4cff80780a5018036cd2a74d35abdc05

    • SHA1

      d49602514b4e6e4a9d9c6d199c0db5ea64359256

    • SHA256

      a7f441793b5703b349ebb2509b6af1cdfdd8023d8e56f1f9a57b9d74e69bd9a9

    • SHA512

      4bf3b76e8cd4ead62b94b3fb38cd1970f3476dcfe64b3065f56c4fd6852dcd1201c134a41c96ed966e6357f7d42dfde0bf7e794a5e16c0174dfec174f06b0d81

    • Zloader, Terdot, DELoader, ZeusSphinx

      Zloader is a malware strain that was initially discovered back in August 2015.

MITRE ATT&CK Matrix

Tasks