Overview

overview

10

Static

static

10

Internet-Win7-30min

windows7_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    330000.dll

  • Size

    150KB

  • Sample

    210324-dnqw6hgnyx

  • MD5

    4209e752839b142cc328261ba570b0d2

  • SHA1

    275a712c823e2a5935145c418d2fe2abe38d2eba

  • SHA256

    6df88e26b94be01b9a7abcd8473f74b9ea7278282421da4bf7dbffa6a53a2a58

  • SHA512

    0b6f903f10f4c1e523f87fc5e5a64c173ab112833748e11d13efed049801d5381aff4139cf3e852c24c25f7049b98a2af16549594ea3ceafe698ae1fc0b692ba

Score
10/10
zloadernut24/03botnettrojan

Malware Config

Extracted

Family

zloader

Botnet

nut

Campaign

24/03

C2

https://electrabeautytools.com/post.php

https://elexitodelonatural.com/post.php

https://elmaaref.com/post.php

https://enrichuae.com/post.php

https://www.epsilon-me.com/post.php

https://codilmeosoterti.tk/post.php
rc4.plain
rsa_pubkey.plain

Targets

    • Target

      330000.dll

    • Size

      150KB

    • MD5

      4209e752839b142cc328261ba570b0d2

    • SHA1

      275a712c823e2a5935145c418d2fe2abe38d2eba

    • SHA256

      6df88e26b94be01b9a7abcd8473f74b9ea7278282421da4bf7dbffa6a53a2a58

    • SHA512

      0b6f903f10f4c1e523f87fc5e5a64c173ab112833748e11d13efed049801d5381aff4139cf3e852c24c25f7049b98a2af16549594ea3ceafe698ae1fc0b692ba

    Score
    10/10
    zloadernut24/03botnettrojan

    • Zloader, Terdot, DELoader, ZeusSphinx

      Zloader is a malware strain that was initially discovered back in August 2015.

      trojanbotnetzloader

    • Blocklisted process makes network request

    • Suspicious use of SetThreadContext

    behavioral1

MITRE ATT&CK Matrix

Tasks