zloader | 5de9ca27c49e20e31c407cc063550d636ea4542d54c505baec36dea643067220

General

Target

d54e97ffba569cdeb7dfb3d4f1202b23368f360b6a1d8cd8472fe4d5650f7513.zip
Size

107KB
Sample

210304-wglbb1mlkj
MD5

6a780751893cbad418e67e6f1916a8ab
SHA1

1fa5e0586a4f2a29fdb890ef8b973bfe3458cb47
SHA256

5de9ca27c49e20e31c407cc063550d636ea4542d54c505baec36dea643067220
SHA512

9ee04437072bb699a762901941cb5080599a98bed0537928d2f9c308ef34805f39b612927b7fcefefed8a1c92e6655c759ff70e5a9c85db7a800d4f01c8c54b5

Score

10^/10

Malware Config

Extracted

Family

zloader

Botnet

DLLobnova

Campaign

2020

C2

https://fdsjfjdsfjdsdsjajjs.com/gate.php

https://idisaudhasdhasdj.com/gate.php

https://dsjdjsjdsadhasdas.com/gate.php

https://dsdjfhdsufudhjas.com/gate.php

https://dsdjfhdsufudhjas.info/gate.php

https://fdsjfjdsfjdsdsjajjs.info/gate.php

https://idisaudhasdhasdj.info/gate.php

rc4.plain

Targets

- Target
  
  d54e97ffba569cdeb7dfb3d4f1202b23368f360b6a1d8cd8472fe4d5650f7513.dll
- Size
  
  172KB
- MD5
  
  fdf181c5b4cb29c4cac89576848aa9c1
- SHA1
  
  de1f74fab204b3dc89f9c0d18da54bf297655719
- SHA256
  
  d54e97ffba569cdeb7dfb3d4f1202b23368f360b6a1d8cd8472fe4d5650f7513
- SHA512
  
  2a62104931807b68c21448c4977cf28e2f58dde046d219089232e0f32385a02eb39f0beb192d28cb60b82816e5565e9e759df4f644dcb7c75eea7b80a86f24da
Score

10^/10

zloader dllobnova 2020 botnet persistence trojan
- Zloader, Terdot, DELoader, ZeusSphinx
  Zloader is a malware strain that was initially discovered back in August 2015.
  trojan botnet zloader
- Blocklisted process makes network request
- Adds Run key to start application
  persistence
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Targets

Zloader, Terdot, DELoader, ZeusSphinx

Blocklisted process makes network request

Adds Run key to start application

Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v6

Tasks

static1

behavioral1

behavioral2