zloader | b270e245132cf6624fc96642532a00c0a16681f59542220ad2c389d45865141f

Target

b270e245132cf6624fc96642532a00c0a16681f59542220ad2c389d45865141f.dll
Size

298KB
MD5

a80859c1cd44daad1450948a1276bc0d
SHA1

46396892b9cafb2e59b8f667ec7822d0435384bb
SHA256

b270e245132cf6624fc96642532a00c0a16681f59542220ad2c389d45865141f
SHA512

ce68470318b8472b30aeee8778802ca4c9175f075a9c19c8332a08a6a8518a2f157a9e2ccaedba1d42f83f591d3c5f233ee1b8b8fbb90589aae82c9dea68352c

Score

10^/10

Malware Config

Family

zloader

Botnet

nut

Campaign

22/03

https://svilapp.svgipsar.org/post.php

https://nadar-gis.com/post.php

https://crearqarquitectos.com/post.php

https://crown-sign.com/post.php

https://dainikjahan.com/post.php

https://denatureedutech.com/post.php

https://alekllemtilaro.tk/post.php

rc4.plain

rsa_pubkey.plain

Zloader, Terdot, DELoader, ZeusSphinx
Zloader is a malware strain that was initially discovered back in August 2015.
trojan botnet zloader

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 568 wrote to memory of 2284	568	rundll32.exe	rundll32.exe
PID 568 wrote to memory of 2284	568	rundll32.exe	rundll32.exe
PID 568 wrote to memory of 2284	568	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\b270e245132cf6624fc96642532a00c0a16681f59542220ad2c389d45865141f.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:568

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\b270e245132cf6624fc96642532a00c0a16681f59542220ad2c389d45865141f.dll,#1
2⤵
PID:2284

memory/2284-114-0x0000000000000000-mapping.dmp

Download
memory/2284-115-0x0000000074310000-0x000000007433B000-memory.dmp

Filesize
172KB

Download
memory/2284-116-0x0000000074310000-0x00000000743B5000-memory.dmp

Filesize
660KB

Download
memory/2284-117-0x0000000000490000-0x0000000000491000-memory.dmp

Filesize
4KB

Download