zloader | 9afda0de1b54bc55060751b6da6b6f047603214f9de8bf05f79a91c8d00ed4c9

Analysis

Target

NALA LIMITED.dll
Size

335KB
MD5

64fcff8a2ff203b88fc722dbd8b5cc97
SHA1

e15c8b910562fea492d5302d2a951acdc239018b
SHA256

9afda0de1b54bc55060751b6da6b6f047603214f9de8bf05f79a91c8d00ed4c9
SHA512

a6c9e2293c8720089d5f5995d75deb738b35ffe0bd9d884ab8084b25f60cdd35ffdca6d7657e642674ac2768237cc6aa9a1766b633efca9cf715a16b6c370b5c

Score

10^/10

Family

zloader

Botnet

personal

Campaign

personal

https://iqowijsdakm.com/gate.php

https://wiewjdmkfjn.com/gate.php

https://dksaoidiakjd.com/gate.php

https://iweuiqjdakjd.com/gate.php

https://yuidskadjna.com/gate.php

https://olksmadnbdj.com/gate.php

https://odsakmdfnbs.com/gate.php

https://odsakjmdnhsaj.com/gate.php

https://odjdnhsaj.com/gate.php

https://odoishsaj.com/gate.php

rc4.plain

rsa_pubkey.plain

Zloader, Terdot, DELoader, ZeusSphinx
Zloader is a malware strain that was initially discovered back in August 2015.
trojan botnet zloader

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 860 wrote to memory of 1516	860	rundll32.exe	rundll32.exe
PID 860 wrote to memory of 1516	860	rundll32.exe	rundll32.exe
PID 860 wrote to memory of 1516	860	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\NALA LIMITED.dll",#1
1⤵
- Suspicious use of WriteProcessMemory
PID:860
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe "C:\Users\Admin\AppData\Local\Temp\NALA LIMITED.dll",#1
  2⤵
  PID:1516
- - C:\Windows\SysWOW64\msiexec.exe
    msiexec.exe
    3⤵
    PID:1816

memory/1516-114-0x0000000000000000-mapping.dmp

Download
memory/1516-115-0x0000000000A00000-0x0000000000AAE000-memory.dmp

Filesize
696KB

Download
memory/1516-116-0x0000000010000000-0x0000000010056000-memory.dmp

Filesize
344KB

Download
memory/1816-117-0x0000000000000000-mapping.dmp

Download
memory/1816-120-0x00000000021D0000-0x00000000021F6000-memory.dmp

Filesize
152KB

Download