zloader | 86c37d778f584a2a3090ab170c8cd2fb3ddf952cde689b4c5a1efd74fc113a05

Analysis

Target

JavaE.dll
Size

279KB
MD5

86cef6c066a05b3f67123fbf638b6b01
SHA1

81618f8ecc48541c219aa974e4b16cab8f34203b
SHA256

86c37d778f584a2a3090ab170c8cd2fb3ddf952cde689b4c5a1efd74fc113a05
SHA512

1132f94eeb8ae5d4556841976789b648f2394a4089db2e6b43c2047cc87004f00e334e14a96c5ab0535aeb13f3bffc8d5e955d7435b9be2aba491bcbe92044d9

Score

10^/10

Family

zloader

Botnet

vasja

Campaign

vasja

https://iqowijsdakm.com/gate.php

https://wiewjdmkfjn.com/gate.php

https://dksaoidiakjd.com/gate.php

https://iweuiqjdakjd.com/gate.php

https://yuidskadjna.com/gate.php

https://olksmadnbdj.com/gate.php

https://odsakmdfnbs.com/gate.php

https://odsakjmdnhsaj.com/gate.php

https://odjdnhsaj.com/gate.php

https://odoishsaj.com/gate.php

rc4.plain

rsa_pubkey.plain

Zloader, Terdot, DELoader, ZeusSphinx
Zloader is a malware strain that was initially discovered back in August 2015.
trojan botnet zloader

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

regsvr32.exe

description	pid	process	target process
PID 3908 wrote to memory of 424	3908	regsvr32.exe	regsvr32.exe
PID 3908 wrote to memory of 424	3908	regsvr32.exe	regsvr32.exe
PID 3908 wrote to memory of 424	3908	regsvr32.exe	regsvr32.exe

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\JavaE.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:3908

C:\Windows\SysWOW64\regsvr32.exe
/s C:\Users\Admin\AppData\Local\Temp\JavaE.dll
2⤵
PID:424

memory/424-114-0x0000000000000000-mapping.dmp

Download
memory/424-116-0x0000000010000000-0x0000000010148000-memory.dmp

Filesize
1.3MB

Download
memory/424-115-0x0000000003F90000-0x0000000003F91000-memory.dmp

Filesize
4KB

Download
memory/3736-117-0x0000000000000000-mapping.dmp

Download
memory/3736-120-0x0000000000360000-0x0000000000386000-memory.dmp

Filesize
152KB

Download