Overview

overview

10

Static

static

10

95560f1a46...f9.dll

windows7_x64

10

95560f1a46...f9.dll

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    95560f1a465e8ba87a73f8e60a6657545073d55c3b5cfc2ffdaf3d69d46afcf9.zip

  • Size

    157KB

  • Sample

    210304-re1nbsszgn

  • MD5

    963133f675a671fd0057b04a4c86da64

  • SHA1

    ff3fb1cc9ef66fb6b065d4b2900cb8a5adb06449

  • SHA256

    1e556f1e19659679408a52f59fce761ad304fecfd563566aa000bd70895ac20b

  • SHA512

    0d8b6377b4c4c019ae29ba3c2ede652de1aa407b8f7c40d09aac4ab22e2b47a5785443a9f707d9f532331f5f238dbb74f0d49ea60b2335fb83f130d91ec04a22

Score
10/10
zloader25/03botnettrojan

Malware Config

Extracted

Family

zloader

Botnet

25/03

C2

https://wgyvjbse.pw/milagrecf.php

https://botiq.xyz/milagrecf.php
rc4.plain

Targets

    • Target

      95560f1a465e8ba87a73f8e60a6657545073d55c3b5cfc2ffdaf3d69d46afcf9.dll

    • Size

      260KB

    • MD5

      9e9719483cc24dc0ab94b31f76981f42

    • SHA1

      dad2cbcedfa94a2d2f0fde521d6f57a094d7c85b

    • SHA256

      95560f1a465e8ba87a73f8e60a6657545073d55c3b5cfc2ffdaf3d69d46afcf9

    • SHA512

      83cff2d55df7d40aea1357515cc673792b367718e57624a2eedd531fd51c49ff165e5e69065efa09148d550644ea1106f54dea35aaadcebaa9ed911532c44309

    Score
    10/10
    zloader25/03botnettrojan

    • Suspicious use of NtCreateProcessExOtherParentProcess

    • Zloader, Terdot, DELoader, ZeusSphinx

      Zloader is a malware strain that was initially discovered back in August 2015.

      trojanbotnetzloader

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks