Overview

overview

10

Static

static

tmp2.dll

windows7_x64

10

tmp2.dll

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    tmp2

  • Size

    454KB

  • Sample

    211004-2j5akahcgq

  • MD5

    3d7ef38e63a73f1b0ca9a3a3ea39f491

  • SHA1

    dba032764df1e3b6bff027183d69c642ef2b123c

  • SHA256

    b4e0478cf85035852a664984f8639e98bee3b54d6530ef22d46874b14ad0e748

  • SHA512

    0f162a402346bc036d4dd7b49b989bf0beb13cbf9ba7a5395f3486fae875726d863b3497de9cdd69947ce0e208e70859b9a069de4168fe8ea6c02b8b339da66b

Score
10/10
zloaderapr01canadabotnetpersistencesuricatatrojan

Malware Config

Extracted

Family

zloader

Botnet

apr01

Campaign

Canada

C2

http://march262020.best/post.php

http://march262020.club/post.php

http://march262020.com/post.php

http://march262020.live/post.php

http://march262020.network/post.php

http://march262020.online/post.php

http://march262020.site/post.php

http://march262020.store/post.php

http://march262020.tech/post.php
rc4.plain

Targets

    • Target

      tmp2

    • Size

      454KB

    • MD5

      3d7ef38e63a73f1b0ca9a3a3ea39f491

    • SHA1

      dba032764df1e3b6bff027183d69c642ef2b123c

    • SHA256

      b4e0478cf85035852a664984f8639e98bee3b54d6530ef22d46874b14ad0e748

    • SHA512

      0f162a402346bc036d4dd7b49b989bf0beb13cbf9ba7a5395f3486fae875726d863b3497de9cdd69947ce0e208e70859b9a069de4168fe8ea6c02b8b339da66b

    Score
    10/10
    zloaderapr01canadabotnetpersistencetrojansuricata

    • Zloader, Terdot, DELoader, ZeusSphinx

      Zloader is a malware strain that was initially discovered back in August 2015.

      trojanbotnetzloader

    • suricata: ET MALWARE Zbot POST Request to C2

      suricata: ET MALWARE Zbot POST Request to C2

      suricata

    • Blocklisted process makes network request

    • Adds Run key to start application

      persistence

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1
T1060

Privilege Escalation

Defense Evasion

Modify Registry

1
T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks