Overview

overview

10

Static

static

start.EXE

windows7_x64

10

start.EXE

windows10_x64

Sharing

Copy URL
Twitter E-mail

General

  • Target

    start.EXE

  • Size

    173KB

  • Sample

    210811-mpnqfjxjyn

  • MD5

    fb5278d8e4a377946c05dca2033f3ac7

  • SHA1

    2c42a1794bf5738128b5badaf0a0eae48cebe0fd

  • SHA256

    9d26e19b8fc5819b634397d48183637bacc9e1c62d8b1856b8116141cb8b4000

  • SHA512

    f40256afe19f91bcdc526bd1c758561470062f754df5974677ac9a83e09b787bb25e5bf4a26f25a9398dbd0b9aeb534bb5435a1cccfc113131755e1c6d2d7975

Score
10/10
zloadervasjavasjabotnetevasionpersistencetrojan

Malware Config

Extracted

Family

zloader

Botnet

vasja

Campaign

vasja

C2

https://iqowijsdakm.com/gate.php

https://wiewjdmkfjn.com/gate.php

https://dksaoidiakjd.com/gate.php

https://iweuiqjdakjd.com/gate.php

https://yuidskadjna.com/gate.php

https://olksmadnbdj.com/gate.php

https://odsakmdfnbs.com/gate.php

https://odsakjmdnhsaj.com/gate.php

https://odjdnhsaj.com/gate.php

https://odoishsaj.com/gate.php
rc4.plain
rsa_pubkey.plain

Targets

    • Target

      start.EXE

    • Size

      173KB

    • MD5

      fb5278d8e4a377946c05dca2033f3ac7

    • SHA1

      2c42a1794bf5738128b5badaf0a0eae48cebe0fd

    • SHA256

      9d26e19b8fc5819b634397d48183637bacc9e1c62d8b1856b8116141cb8b4000

    • SHA512

      f40256afe19f91bcdc526bd1c758561470062f754df5974677ac9a83e09b787bb25e5bf4a26f25a9398dbd0b9aeb534bb5435a1cccfc113131755e1c6d2d7975

    Score
    10/10
    zloadervasjavasjabotnetpersistencetrojanevasion

    • Zloader, Terdot, DELoader, ZeusSphinx

      Zloader is a malware strain that was initially discovered back in August 2015.

      trojanbotnetzloader

    • Blocklisted process makes network request

    • Downloads MZ/PE file

    • Modifies Windows Firewall

      evasion

    • Loads dropped DLL

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Modify Existing Service

1
T1031

Registry Run Keys / Startup Folder

1
T1060

Privilege Escalation

Defense Evasion

Modify Registry

1
T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks