Overview

overview

10

Static

static

tmp.dll

windows7_x64

10

tmp.dll

windows10_x64

10

Resubmissions

14-04-2022 02:16

220414-cp91kagbem 10

04-10-2021 22:37

211004-2jzp3shcgp 10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    tmp

  • Size

    444KB

  • Sample

    211004-2jzp3shcgp

  • MD5

    c6b350b0d6f8dc37c144f76a57c9dbe7

  • SHA1

    e637d8a29d46281a5fa97d84af1dfe1d72223157

  • SHA256

    6348bded936831629494c1d820fe8e3dbe3fb4d9f96940bbb4ca0c1872bef0ad

  • SHA512

    5220ff154b731a8a1d1e768552fee037cacb12412eff931384c105d4caa5483da64c11b4839ab44885214d4d8831b280687b54b2438f89a230fce68bf7692dff

Score
10/10
zloader26/03botnetpersistencetrojan

Malware Config

Extracted

Family

zloader

Botnet

26/03

C2

https://vfgthujbxd.xyz/milagrecf.php

https://todiks.xyz/milagrecf.php
rc4.plain

Targets

    • Target

      tmp

    • Size

      444KB

    • MD5

      c6b350b0d6f8dc37c144f76a57c9dbe7

    • SHA1

      e637d8a29d46281a5fa97d84af1dfe1d72223157

    • SHA256

      6348bded936831629494c1d820fe8e3dbe3fb4d9f96940bbb4ca0c1872bef0ad

    • SHA512

      5220ff154b731a8a1d1e768552fee037cacb12412eff931384c105d4caa5483da64c11b4839ab44885214d4d8831b280687b54b2438f89a230fce68bf7692dff

    Score
    10/10
    zloader26/03botnetpersistencetrojan

    • Zloader, Terdot, DELoader, ZeusSphinx

      Zloader is a malware strain that was initially discovered back in August 2015.

      trojanbotnetzloader

    • Adds Run key to start application

      persistence

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1
T1060

Privilege Escalation

Defense Evasion

Modify Registry

1
T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks