zloader | 66ab31fc088b2b58b1ab428a06b6bf067ca401947ba4f17bbb6ffe5f46f1c473

Target

95a8370c36d81ea596d83892115ce6b90717396c8f657b17696c7eeb2dba1d2e.dll
Size

429KB
MD5

75784d297b3d6fb4d434b6890f6334ab
SHA1

dc945e57be6bdd3cc4894d6cff7dd90a76f6c416
SHA256

95a8370c36d81ea596d83892115ce6b90717396c8f657b17696c7eeb2dba1d2e
SHA512

f54baffc5b545aaa4d939505181466d7b78bb583fd32da6cbf8cea058fca8869e8bf7bf3272f43d09a7b24dc6e821c9aa0e3875dd2959173e704d57568915fa1

Score

10^/10

Malware Config

Family

zloader

Botnet

tim

Campaign

tim

https://iqowijsdakm.com/gate.php

https://wiewjdmkfjn.com/gate.php

https://dksaoidiakjd.com/gate.php

https://iweuiqjdakjd.com/gate.php

https://yuidskadjna.com/gate.php

https://olksmadnbdj.com/gate.php

https://odsakmdfnbs.com/gate.php

https://odsakjmdnhsaj.com/gate.php

https://odjdnhsaj.com/gate.php

https://odoishsaj.com/gate.php

rc4.plain

rsa_pubkey.plain

Zloader, Terdot, DELoader, ZeusSphinx
Zloader is a malware strain that was initially discovered back in August 2015.
trojan botnet zloader
suricata: ET MALWARE Observed ZLoader CnC Domain in SNI
suricata: ET MALWARE Observed ZLoader CnC Domain in SNI
suricata
Drops file in Windows directory 1 IoCs

Processes:

regsvr32.exe

description ioc process

File opened for modification C:\Windows\ regsvr32.exe

description	ioc	process
File opened for modification	C:\Windows\	regsvr32.exe

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

regsvr32.exe

description	pid	process	target process
PID 672 wrote to memory of 1424	672	regsvr32.exe	regsvr32.exe
PID 672 wrote to memory of 1424	672	regsvr32.exe	regsvr32.exe
PID 672 wrote to memory of 1424	672	regsvr32.exe	regsvr32.exe
PID 672 wrote to memory of 1424	672	regsvr32.exe	regsvr32.exe
PID 672 wrote to memory of 1424	672	regsvr32.exe	regsvr32.exe
PID 672 wrote to memory of 1424	672	regsvr32.exe	regsvr32.exe
PID 672 wrote to memory of 1424	672	regsvr32.exe	regsvr32.exe

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\95a8370c36d81ea596d83892115ce6b90717396c8f657b17696c7eeb2dba1d2e.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:672

C:\Windows\SysWOW64\regsvr32.exe
/s C:\Users\Admin\AppData\Local\Temp\95a8370c36d81ea596d83892115ce6b90717396c8f657b17696c7eeb2dba1d2e.dll
2⤵
- Drops file in Windows directory
PID:1424

memory/672-55-0x000007FEFB7E1000-0x000007FEFB7E3000-memory.dmp

Filesize
8KB

Download
memory/832-61-0x00000000000C0000-0x00000000000C1000-memory.dmp

Filesize
4KB

Download
memory/832-60-0x0000000000090000-0x00000000000B6000-memory.dmp

Filesize
152KB

Download
memory/832-62-0x0000000000090000-0x00000000000B6000-memory.dmp

Filesize
152KB

Download
memory/832-63-0x0000000000000000-mapping.dmp

Download
memory/832-65-0x0000000000090000-0x00000000000B6000-memory.dmp

Filesize
152KB

Download
memory/1424-56-0x0000000000000000-mapping.dmp

Download
memory/1424-57-0x0000000075AC1000-0x0000000075AC3000-memory.dmp

Filesize
8KB

Download
memory/1424-58-0x0000000000100000-0x0000000000101000-memory.dmp

Filesize
4KB

Download
memory/1424-59-0x0000000010000000-0x0000000010072000-memory.dmp

Filesize
456KB

Download