Overview

overview

10

Static

static

x.dll

windows7_x64

10

x.dll

windows10_x64

10

Resubmissions

04-03-2021 12:53

210304-xck4l4syjs 10

12-05-2020 16:48

200512-fh9ngk8kpj 10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    x.dll

  • Size

    800KB

  • Sample

    210304-xck4l4syjs

  • MD5

    c1366b1afc57e2fca68501345bbd4ba0

  • SHA1

    1dbbc632e2b10918c322ed0e761661fbe690d43e

  • SHA256

    692c58e28e0f0346adfbad2356dd8495ec8f07718ee40db171b50e8870526f96

  • SHA512

    ad290473ef61838d67fbf2812d381519b1fabbb50e15c088cd45fe6ea4d9d27ed6615bbffb459dccfdad116706989c881db96fceeef9a94180310c5db5c3b80c

Score
10/10
zloadermiguel12/05botnettrojan

Malware Config

Extracted

Family

zloader

Botnet

miguel

Campaign

12/05

C2

https://japanjisho.info/wp-parser.php

https://home.comegico.com.mx/wp-parser.php

https://hormonas.comegico.com.mx/wp-parser.php

https://hopime.com/wp-parser.php

https://gavrelets.ru/wp-parser.php
rc4.plain

Targets

    • Target

      x.dll

    • Size

      800KB

    • MD5

      c1366b1afc57e2fca68501345bbd4ba0

    • SHA1

      1dbbc632e2b10918c322ed0e761661fbe690d43e

    • SHA256

      692c58e28e0f0346adfbad2356dd8495ec8f07718ee40db171b50e8870526f96

    • SHA512

      ad290473ef61838d67fbf2812d381519b1fabbb50e15c088cd45fe6ea4d9d27ed6615bbffb459dccfdad116706989c881db96fceeef9a94180310c5db5c3b80c

    Score
    10/10
    zloadermiguel12/05botnettrojan

    • Zloader, Terdot, DELoader, ZeusSphinx

      Zloader is a malware strain that was initially discovered back in August 2015.

      trojanbotnetzloader

    • Blocklisted process makes network request

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks