zloader | b73bae190d2c8d18cbf00584c496e4f570da582507dbdbacdc8893053e5996ae

Analysis

Target

b73bae190d2c8d18cbf00584c496e4f570da582507dbdbacdc8893053e5996ae.dll
Size

306KB
MD5

4f134d35f7d1afe6c91085f38e27640d
SHA1

0102f545e6b8acefaff628159cd06697d9c520b7
SHA256

b73bae190d2c8d18cbf00584c496e4f570da582507dbdbacdc8893053e5996ae
SHA512

3bd09ea9b443fce5c9f78430b9e7254513907be81751ee671a133f7d2c46ad17c868fcdb5d382ee3a8cf4d2b931f5b07c2d86b52dea9f75b5dfa722b12c4abb9

Score

10^/10

Family

zloader

Botnet

personal

Campaign

personal

https://iqowijsdakm.com/gate.php

https://wiewjdmkfjn.com/gate.php

https://dksaoidiakjd.com/gate.php

https://iweuiqjdakjd.com/gate.php

https://yuidskadjna.com/gate.php

https://olksmadnbdj.com/gate.php

https://odsakmdfnbs.com/gate.php

https://odsakjmdnhsaj.com/gate.php

https://odjdnhsaj.com/gate.php

https://odoishsaj.com/gate.php

rc4.plain

rsa_pubkey.plain

Zloader, Terdot, DELoader, ZeusSphinx
Zloader is a malware strain that was initially discovered back in August 2015.
trojan botnet zloader

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 736 wrote to memory of 1676	736	rundll32.exe	rundll32.exe
PID 736 wrote to memory of 1676	736	rundll32.exe	rundll32.exe
PID 736 wrote to memory of 1676	736	rundll32.exe	rundll32.exe
PID 736 wrote to memory of 1676	736	rundll32.exe	rundll32.exe
PID 736 wrote to memory of 1676	736	rundll32.exe	rundll32.exe
PID 736 wrote to memory of 1676	736	rundll32.exe	rundll32.exe
PID 736 wrote to memory of 1676	736	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\b73bae190d2c8d18cbf00584c496e4f570da582507dbdbacdc8893053e5996ae.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:736

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\b73bae190d2c8d18cbf00584c496e4f570da582507dbdbacdc8893053e5996ae.dll,#1
2⤵
PID:1676

memory/1300-64-0x0000000000000000-mapping.dmp

Download
memory/1300-66-0x0000000000090000-0x00000000000B6000-memory.dmp

Filesize
152KB

Download
memory/1676-60-0x0000000000000000-mapping.dmp

Download
memory/1676-61-0x00000000757E1000-0x00000000757E3000-memory.dmp

Filesize
8KB

Download
memory/1676-62-0x0000000000160000-0x0000000000182000-memory.dmp

Filesize
136KB

Download
memory/1676-63-0x0000000010000000-0x0000000010050000-memory.dmp

Filesize
320KB

Download