Overview

overview

10

Static

static

cYg4dkuO.dll

windows7_x64

10

cYg4dkuO.dll

windows10_x64

1

Sharing

Copy URL Twitter E-mail

General

  • Target
    cYg4dkuO.dll
  • Size 688KB
  • Sample210324-clw1bf67ln
  • SHA256 3787d90c7fa9f7b2803b904476eff287d4f59d1fe550f248250e84ca8885065f
  • MD5 SHA1 SHA512
Score
10/10
zloadernut24/03botnettrojan

Malware Config

Extracted

Family

  • zloader

Botnet

  • nut

Campaign

  • 24/03

C2

  • https://electrabeautytools.com/post.php

  • https://elexitodelonatural.com/post.php

  • https://elmaaref.com/post.php

  • https://enrichuae.com/post.php

  • https://www.epsilon-me.com/post.php

  • https://codilmeosoterti.tk/post.php

rc4.plain
rsa_pubkey.plain

Targets

    • Target
      cYg4dkuO.dll
    • Size 688KB
    • SHA256 3787d90c7fa9f7b2803b904476eff287d4f59d1fe550f248250e84ca8885065f
    • MD5 SHA1 SHA512
    Score
    10/10
    zloadernut24/03botnettrojan

    • Zloader, Terdot, DELoader, ZeusSphinx

      Zloader is a malware strain that was initially discovered back in August 2015.

      trojanbotnetzloader

    • Blocklisted process makes network request

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks