zloader | 8eea435b67f4fe16b31c412a0648da64b919fd7eff69e33f22730ff5445e6fe3

Analysis

Target

8eea435b67f4fe16b31c412a0648da64b919fd7eff69e33f22730ff5445e6fe3.dll
Size

306KB
MD5

993ac46f574f979e7c4353a710dad8a9
SHA1

9ea1f0d5f56155d71a6e39208ea2b8bb67dbcf6d
SHA256

8eea435b67f4fe16b31c412a0648da64b919fd7eff69e33f22730ff5445e6fe3
SHA512

aa4024e90a9a4bfec1bd6d923e42b37a4c1981a3a9c6c910811f128963f9d8aa06c71c11730ea63ec7f2888c3070b1783b93290fa568f848be3a115b43239869

Score

10^/10

Family

zloader

Botnet

googleaktualizacija

Campaign

googleaktualizacija2

https://iqowijsdakm.com/gate.php

https://wiewjdmkfjn.com/gate.php

https://dksaoidiakjd.com/gate.php

https://iweuiqjdakjd.com/gate.php

https://yuidskadjna.com/gate.php

https://olksmadnbdj.com/gate.php

https://odsakmdfnbs.com/gate.php

https://odsakjmdnhsaj.com/gate.php

https://odjdnhsaj.com/gate.php

https://odoishsaj.com/gate.php

rc4.plain

rsa_pubkey.plain

Zloader, Terdot, DELoader, ZeusSphinx
Zloader is a malware strain that was initially discovered back in August 2015.
trojan botnet zloader

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 1860 wrote to memory of 2032	1860	rundll32.exe	rundll32.exe
PID 1860 wrote to memory of 2032	1860	rundll32.exe	rundll32.exe
PID 1860 wrote to memory of 2032	1860	rundll32.exe	rundll32.exe
PID 1860 wrote to memory of 2032	1860	rundll32.exe	rundll32.exe
PID 1860 wrote to memory of 2032	1860	rundll32.exe	rundll32.exe
PID 1860 wrote to memory of 2032	1860	rundll32.exe	rundll32.exe
PID 1860 wrote to memory of 2032	1860	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\8eea435b67f4fe16b31c412a0648da64b919fd7eff69e33f22730ff5445e6fe3.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1860

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\8eea435b67f4fe16b31c412a0648da64b919fd7eff69e33f22730ff5445e6fe3.dll,#1
2⤵
PID:2032

memory/1652-63-0x0000000000000000-mapping.dmp

Download
memory/1652-65-0x0000000000090000-0x00000000000B6000-memory.dmp

Filesize
152KB

Download
memory/2032-59-0x0000000000000000-mapping.dmp

Download
memory/2032-60-0x0000000075721000-0x0000000075723000-memory.dmp

Filesize
8KB

Download
memory/2032-61-0x0000000000210000-0x0000000000232000-memory.dmp

Filesize
136KB

Download
memory/2032-62-0x0000000010000000-0x0000000010050000-memory.dmp

Filesize
320KB

Download