Overview

overview

10

Static

static

10

becacb52a5...62.exe

windows7_x64

10

becacb52a5...62.exe

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    becacb52a50004d42538cfe82c8f527f1793727c5f679f46df7f96eade272962

  • Size

    146KB

  • Sample

    211004-nvsh9agbh9

  • MD5

    d93ca01a4515732a6a54df0a391c93e3

  • SHA1

    ba31585616c3640a434c4c29193f0f89e8306485

  • SHA256

    becacb52a50004d42538cfe82c8f527f1793727c5f679f46df7f96eade272962

  • SHA512

    3e9c52c04cf37250e8d4e0e3a17cc27e17a1ff19c4935a788b77dafea28bd6ec0a514bdbe4073845c31559652c039f88f811b24020044c0b0e0c47f1cb9ac2e0

Score
10/10
zloader-pit14web7-pit14botnetpersistencetrojan

Malware Config

Extracted

Family

zloader

Botnet

-pit14

Campaign

web7-pit14

C2

https://45.72.3.132/web7643/gate.php

rc4.plain

Targets

    • Target

      becacb52a50004d42538cfe82c8f527f1793727c5f679f46df7f96eade272962

    • Size

      146KB

    • MD5

      d93ca01a4515732a6a54df0a391c93e3

    • SHA1

      ba31585616c3640a434c4c29193f0f89e8306485

    • SHA256

      becacb52a50004d42538cfe82c8f527f1793727c5f679f46df7f96eade272962

    • SHA512

      3e9c52c04cf37250e8d4e0e3a17cc27e17a1ff19c4935a788b77dafea28bd6ec0a514bdbe4073845c31559652c039f88f811b24020044c0b0e0c47f1cb9ac2e0

    Score
    10/10
    zloader-pit14web7-pit14botnetpersistencetrojan

    • Zloader, Terdot, DELoader, ZeusSphinx

      Zloader is a malware strain that was initially discovered back in August 2015.

      trojanbotnetzloader

    • Blocklisted process makes network request

    • Adds Run key to start application

      persistence

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1
T1060

Privilege Escalation

Defense Evasion

Modify Registry

1
T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks