zloader | a212778b12315f3eb63ed3cdfae0c21b30caff84e63218c790b81c12993e0834

Analysis

Target

b270e245132cf6624fc96642532a00c0a16681f59542220ad2c389d45865141f.dll
Size

298KB
MD5

a80859c1cd44daad1450948a1276bc0d
SHA1

46396892b9cafb2e59b8f667ec7822d0435384bb
SHA256

b270e245132cf6624fc96642532a00c0a16681f59542220ad2c389d45865141f
SHA512

ce68470318b8472b30aeee8778802ca4c9175f075a9c19c8332a08a6a8518a2f157a9e2ccaedba1d42f83f591d3c5f233ee1b8b8fbb90589aae82c9dea68352c

Score

10^/10

Family

zloader

Botnet

nut

Campaign

22/03

https://svilapp.svgipsar.org/post.php

https://nadar-gis.com/post.php

https://crearqarquitectos.com/post.php

https://crown-sign.com/post.php

https://dainikjahan.com/post.php

https://denatureedutech.com/post.php

https://alekllemtilaro.tk/post.php

rc4.plain

rsa_pubkey.plain

Zloader, Terdot, DELoader, ZeusSphinx
Zloader is a malware strain that was initially discovered back in August 2015.
trojan botnet zloader

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 1032 wrote to memory of 3744	1032	rundll32.exe	rundll32.exe
PID 1032 wrote to memory of 3744	1032	rundll32.exe	rundll32.exe
PID 1032 wrote to memory of 3744	1032	rundll32.exe	rundll32.exe

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\b270e245132cf6624fc96642532a00c0a16681f59542220ad2c389d45865141f.dll,#1
1⤵
PID:3744

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\b270e245132cf6624fc96642532a00c0a16681f59542220ad2c389d45865141f.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1032

memory/3744-2-0x0000000000000000-mapping.dmp

Download
memory/3744-3-0x00000000742D0000-0x00000000742FB000-memory.dmp

Filesize
172KB

Download
memory/3744-4-0x0000000002FF0000-0x0000000002FF1000-memory.dmp

Filesize
4KB

Download