Overview

overview

10

Static

static

9

ccb4128706...4d.dll

windows7_x64

10

ccb4128706...4d.dll

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    ccb412870602bd52d4fc05038bba4d958e9766c66bff92d9ce9800dbf901834d.dll

  • Size

    527KB

  • Sample

    210421-3z7jhx7tjx

  • MD5

    9d19acb3d8bc7578715d85c03ff10014

  • SHA1

    9e199d963983bf92e3b2f3d08d9b4817af567748

  • SHA256

    ccb412870602bd52d4fc05038bba4d958e9766c66bff92d9ce9800dbf901834d

  • SHA512

    19749d3a7ba8ca043897af061d8f7f8dbe6b6f34df698ccba7b0ac31b57ec5918b7d8d193dd9dd50f072d4ff218c07f6c23eb3f5153451a5774b8c8db3b9ad9c

Score
10/10
zloadermain10.05.2020botnetcryptonepackerpersistencetrojan

Malware Config

Extracted

Family

zloader

Botnet

main

Campaign

10.05.2020

C2

https://sigmark.org/sound.php

https://perditta.org/sound.php

https://dentatox.org/sound.php

https://flopperos.org/sound.php

https://teslatis.org/sound.php

https://teamper.org/sound.php

https://gilantec.org/sound.php

https://trebitmore.org/sound.php
rc4.plain

Targets

    • Target

      ccb412870602bd52d4fc05038bba4d958e9766c66bff92d9ce9800dbf901834d.dll

    • Size

      527KB

    • MD5

      9d19acb3d8bc7578715d85c03ff10014

    • SHA1

      9e199d963983bf92e3b2f3d08d9b4817af567748

    • SHA256

      ccb412870602bd52d4fc05038bba4d958e9766c66bff92d9ce9800dbf901834d

    • SHA512

      19749d3a7ba8ca043897af061d8f7f8dbe6b6f34df698ccba7b0ac31b57ec5918b7d8d193dd9dd50f072d4ff218c07f6c23eb3f5153451a5774b8c8db3b9ad9c

    Score
    10/10
    zloadermain10.05.2020botnetpersistencetrojan

    • Zloader, Terdot, DELoader, ZeusSphinx

      Zloader is a malware strain that was initially discovered back in August 2015.

      trojanbotnetzloader

    • Adds Run key to start application

      persistence

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1
T1060

Privilege Escalation

Defense Evasion

Modify Registry

1
T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks