General

  • Target

    2021-03-08-Spelevo-EK-payload-ZLoader-EXE.bin

  • Size

    292KB

  • Sample

    210308-rctfmtz5b6

  • MD5

    a552a092b08cd01310b87ee994a21bc2

  • SHA1

    8d9b3a09a70914a0a20f42a79474abba34737206

  • SHA256

    9ef6c5467fd80274e6a37e2883a5e83a894cf2148ce37bf0adb1e884acbc4c0b

  • SHA512

    fd504086bb67b7e9c6d492a3d4efa6ca56f91fd47df5b45c21451164825b6451b1d55392565c7aa47f7ed0c594ecdbc69a1753c595604118d4d9e3943af545d5

Malware Config

Extracted

Family

zloader

Botnet

googleaktualizacija

Campaign

googleaktualizacija2

C2

https://iqowijsdakm.com/gate.php

https://wiewjdmkfjn.com/gate.php

https://dksaoidiakjd.com/gate.php

https://iweuiqjdakjd.com/gate.php

https://yuidskadjna.com/gate.php

https://olksmadnbdj.com/gate.php

https://odsakmdfnbs.com/gate.php

https://odsakjmdnhsaj.com/gate.php

https://odjdnhsaj.com/gate.php

https://odoishsaj.com/gate.php

rc4.plain
rsa_pubkey.plain

Targets

    • Target

      2021-03-08-Spelevo-EK-payload-ZLoader-EXE.bin

    • Size

      292KB

    • MD5

      a552a092b08cd01310b87ee994a21bc2

    • SHA1

      8d9b3a09a70914a0a20f42a79474abba34737206

    • SHA256

      9ef6c5467fd80274e6a37e2883a5e83a894cf2148ce37bf0adb1e884acbc4c0b

    • SHA512

      fd504086bb67b7e9c6d492a3d4efa6ca56f91fd47df5b45c21451164825b6451b1d55392565c7aa47f7ed0c594ecdbc69a1753c595604118d4d9e3943af545d5

    • Zloader, Terdot, DELoader, ZeusSphinx

      Zloader is a malware strain that was initially discovered back in August 2015.

MITRE ATT&CK Matrix

Tasks