zloader | 0a83ca0e30b28dcaa0ef247a6aaf808ebc60b60380a25cafa628c5917a2b69b7

Analysis

Target

microsoft_shared.tmp.dll
Size

686KB
MD5

7a75045c4c927433aa7258833355c403
SHA1

c9fb3583b403cc8ed0186971ee300629fd91525f
SHA256

eb12afe158fd7f4236a98c7c6b686dfe9838c3d986c28b593a54303c68534661
SHA512

e1ef63423f04f0047a89b72537aa6d0068e842304e69146e766e83a7b261025765944858d699480f66d38655c4fa5e20b04e96fff9a0397f27db92016cb2c02b

Score

10^/10

Family

zloader

Botnet

personal

Campaign

personal

https://iqowijsdakm.com/gate.php

https://wiewjdmkfjn.com/gate.php

https://dksaoidiakjd.com/gate.php

https://iweuiqjdakjd.com/gate.php

https://yuidskadjna.com/gate.php

https://olksmadnbdj.com/gate.php

https://odsakmdfnbs.com/gate.php

https://odsakjmdnhsaj.com/gate.php

https://odjdnhsaj.com/gate.php

https://odoishsaj.com/gate.php

rc4.plain

rsa_pubkey.plain

Zloader, Terdot, DELoader, ZeusSphinx
Zloader is a malware strain that was initially discovered back in August 2015.
trojan botnet zloader

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

regsvr32.exe

description	pid	process	target process
PID 1144 wrote to memory of 3232	1144	regsvr32.exe	regsvr32.exe
PID 1144 wrote to memory of 3232	1144	regsvr32.exe	regsvr32.exe
PID 1144 wrote to memory of 3232	1144	regsvr32.exe	regsvr32.exe

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\microsoft_shared.tmp.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:1144

C:\Windows\SysWOW64\regsvr32.exe
/s C:\Users\Admin\AppData\Local\Temp\microsoft_shared.tmp.dll
2⤵
PID:3232

memory/1652-5-0x0000000000000000-mapping.dmp

Download
memory/1652-6-0x00000000007C0000-0x00000000007E6000-memory.dmp

Filesize
152KB

Download
memory/3232-2-0x0000000000000000-mapping.dmp

Download
memory/3232-3-0x00000000005C0000-0x00000000005C1000-memory.dmp

Filesize
4KB

Download
memory/3232-4-0x00000000042C0000-0x000000000436F000-memory.dmp

Filesize
700KB

Download