zloader | e6e972d93f6d8d1dbb56f41027614d7738bbe73d9a8cc65de8b06da666440ae5

Analysis

Target

JavaE.dll
Size

953KB
MD5

309661983ec46afb1868c9b8954d6b5e
SHA1

407264334d98faca1d0945a554efeea9b9b3ad00
SHA256

e6e972d93f6d8d1dbb56f41027614d7738bbe73d9a8cc65de8b06da666440ae5
SHA512

1006b5e07bf686975c92a30372b1f83ea7c39f45b6597f66137dca2fa61d7648f690d04c85c8c20bc5b2bf04bba48c8ac851e9f06d354e867deb8189f2e683c6

Score

10^/10

Family

zloader

Botnet

vasja

Campaign

vasja

https://iqowijsdakm.com/gate.php

https://wiewjdmkfjn.com/gate.php

https://dksaoidiakjd.com/gate.php

https://iweuiqjdakjd.com/gate.php

https://yuidskadjna.com/gate.php

https://olksmadnbdj.com/gate.php

https://odsakmdfnbs.com/gate.php

https://odsakjmdnhsaj.com/gate.php

https://odjdnhsaj.com/gate.php

https://odoishsaj.com/gate.php

rc4.plain

rsa_pubkey.plain

Zloader, Terdot, DELoader, ZeusSphinx
Zloader is a malware strain that was initially discovered back in August 2015.
trojan botnet zloader

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

regsvr32.exe

description	pid	process	target process
PID 360 wrote to memory of 1816	360	regsvr32.exe	regsvr32.exe
PID 360 wrote to memory of 1816	360	regsvr32.exe	regsvr32.exe
PID 360 wrote to memory of 1816	360	regsvr32.exe	regsvr32.exe
PID 360 wrote to memory of 1816	360	regsvr32.exe	regsvr32.exe
PID 360 wrote to memory of 1816	360	regsvr32.exe	regsvr32.exe
PID 360 wrote to memory of 1816	360	regsvr32.exe	regsvr32.exe
PID 360 wrote to memory of 1816	360	regsvr32.exe	regsvr32.exe

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\JavaE.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:360

C:\Windows\SysWOW64\regsvr32.exe
/s C:\Users\Admin\AppData\Local\Temp\JavaE.dll
2⤵
PID:1816

memory/360-60-0x000007FEFB7B1000-0x000007FEFB7B3000-memory.dmp

Filesize
8KB

Download
memory/1324-65-0x0000000000000000-mapping.dmp

Download
memory/1324-67-0x00000000000D0000-0x00000000000F6000-memory.dmp

Filesize
152KB

Download
memory/1816-61-0x0000000000000000-mapping.dmp

Download
memory/1816-62-0x0000000075451000-0x0000000075453000-memory.dmp

Filesize
8KB

Download
memory/1816-63-0x00000000000C0000-0x00000000000C1000-memory.dmp

Filesize
4KB

Download
memory/1816-64-0x0000000010000000-0x0000000010155000-memory.dmp

Filesize
1.3MB

Download