Overview

overview

10

Static

static

w.dll

windows7_x64

10

w.dll

windows10_x64

10

Resubmissions

04-03-2021 13:48

210304-6k8nxhjlda 10

05-06-2020 16:46

200605-edh9dgsrjn 10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    w.dll

  • Size

    492KB

  • Sample

    210304-6k8nxhjlda

  • MD5

    892fbc87fdbcbe9d91e17ae7355eb54c

  • SHA1

    c0e25d2f02a768def644be6c248732da4f91495b

  • SHA256

    67b46301815d5ba32f90af114a459810902ba6d97a75821c8455b8103073b499

  • SHA512

    09c30eef3c57be57ef396ff1c2de92f0cff1b57bea0e56ab6401b844b4c5982c7a56f3ef708d0aff2bb6ea1baaef5cf39098b6623bc529c579b35ad73ea4039a

Score
10/10
zloadermiguel05/06botnettrojan

Malware Config

Extracted

Family

zloader

Botnet

miguel

Campaign

05/06

C2

https://gahotimaskever.ga/wp-parser.php

https://tlenexicagopca.tk/wp-parser.php

http://cld.kazgau.com/wp-parser.php

https://cmso.med.cmu.ac.th/wp-parser.php

http://janekleeb.com/wp-parser.php
rc4.plain
rsa_pubkey.plain

Targets

    • Target

      w.dll

    • Size

      492KB

    • MD5

      892fbc87fdbcbe9d91e17ae7355eb54c

    • SHA1

      c0e25d2f02a768def644be6c248732da4f91495b

    • SHA256

      67b46301815d5ba32f90af114a459810902ba6d97a75821c8455b8103073b499

    • SHA512

      09c30eef3c57be57ef396ff1c2de92f0cff1b57bea0e56ab6401b844b4c5982c7a56f3ef708d0aff2bb6ea1baaef5cf39098b6623bc529c579b35ad73ea4039a

    Score
    10/10
    zloadermiguel05/06botnettrojan

    • Zloader, Terdot, DELoader, ZeusSphinx

      Zloader is a malware strain that was initially discovered back in August 2015.

      trojanbotnetzloader

    • Blocklisted process makes network request

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks