Resubmissions

12-10-2021 11:00

211012-m4dk1scbdp 10

04-10-2021 11:08

211004-m8mpgsgbf9 10

General

  • Target

    c55a25514c0d860980e5f13b138ae846b36a783a0fdb52041e3a8c6a22c6f5e2

  • Size

    372KB

  • Sample

    211012-m4dk1scbdp

  • MD5

    bb1272e0e3289985b4578f1b013fa5d5

  • SHA1

    b19802976ff277fd4dd1adb5e950d84a3fcf6cf5

  • SHA256

    c55a25514c0d860980e5f13b138ae846b36a783a0fdb52041e3a8c6a22c6f5e2

  • SHA512

    24cc60455a51a598482f6c1143e9027736dc4c82ca58aa8ae0e3c540006491d5b005284bf32167876ffaa60bedfa114cc59b07faa2b3e87b80b9f08713a18d42

Malware Config

Extracted

Family

zloader

Botnet

kev

Campaign

21/01

C2

https://patatai.com/post.php

https://acquaie.com/post.php

https://noifatemmuce.tk/post.php

rc4.plain
rsa_pubkey.plain

Targets

    • Target

      c55a25514c0d860980e5f13b138ae846b36a783a0fdb52041e3a8c6a22c6f5e2

    • Size

      372KB

    • MD5

      bb1272e0e3289985b4578f1b013fa5d5

    • SHA1

      b19802976ff277fd4dd1adb5e950d84a3fcf6cf5

    • SHA256

      c55a25514c0d860980e5f13b138ae846b36a783a0fdb52041e3a8c6a22c6f5e2

    • SHA512

      24cc60455a51a598482f6c1143e9027736dc4c82ca58aa8ae0e3c540006491d5b005284bf32167876ffaa60bedfa114cc59b07faa2b3e87b80b9f08713a18d42

    • Zloader, Terdot, DELoader, ZeusSphinx

      Zloader is a malware strain that was initially discovered back in August 2015.

    • suricata: ET MALWARE Possible Compromised Host AnubisNetworks Sinkhole Cookie Value Snkz

      suricata: ET MALWARE Possible Compromised Host AnubisNetworks Sinkhole Cookie Value Snkz

    • suricata: ET MALWARE Zbot POST Request to C2

      suricata: ET MALWARE Zbot POST Request to C2

    • Blocklisted process makes network request

    • Suspicious use of SetThreadContext

MITRE ATT&CK Matrix

Tasks