Overview

overview

10

Static

static

SophosAmsi...er.dll

windows7_x64

10

SophosAmsi...er.dll

windows10_x64

10

Resubmissions

03-11-2021 17:08

211103-vnrrpsecf5 10

28-10-2021 11:34

211028-nphf4agcan 10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    SophosAmsiProvider.dll

  • Size

    432KB

  • Sample

    211028-nphf4agcan

  • MD5

    2b3251fe929788b34fd4af2b12c0ca09

  • SHA1

    c58283831eb0d495b42236ff1ee59b05d6101873

  • SHA256

    eecf912bfb121a06499dd43e8f62381d18a8b9efdc9e57aa2ae3d355cb28794e

  • SHA512

    dd202ac9207c9e481911f29892c7fab12dc394349c51b318ab436d93c57f3217b3f52ba5bbc5fe0722bb5375fdd379810baaee334cc21cd34e7c09f357bfc386

Score
10/10
zloadervasjavasjabotnetsuricatatrojan

Malware Config

Extracted

Family

zloader

Botnet

vasja

Campaign

vasja

C2

https://iqowijsdakm.com/gate.php

https://wiewjdmkfjn.com/gate.php

https://dksaoidiakjd.com/gate.php

https://iweuiqjdakjd.com/gate.php

https://yuidskadjna.com/gate.php

https://olksmadnbdj.com/gate.php

https://odsakmdfnbs.com/gate.php

https://odsakjmdnhsaj.com/gate.php

https://odjdnhsaj.com/gate.php

https://odoishsaj.com/gate.php
rc4.plain
rsa_pubkey.plain

Targets

    • Target

      SophosAmsiProvider.dll

    • Size

      432KB

    • MD5

      2b3251fe929788b34fd4af2b12c0ca09

    • SHA1

      c58283831eb0d495b42236ff1ee59b05d6101873

    • SHA256

      eecf912bfb121a06499dd43e8f62381d18a8b9efdc9e57aa2ae3d355cb28794e

    • SHA512

      dd202ac9207c9e481911f29892c7fab12dc394349c51b318ab436d93c57f3217b3f52ba5bbc5fe0722bb5375fdd379810baaee334cc21cd34e7c09f357bfc386

    Score
    10/10
    zloadervasjavasjabotnetsuricatatrojan

    • Zloader, Terdot, DELoader, ZeusSphinx

      Zloader is a malware strain that was initially discovered back in August 2015.

      trojanbotnetzloader

    • suricata: ET MALWARE Observed ZLoader CnC Domain in SNI

      suricata: ET MALWARE Observed ZLoader CnC Domain in SNI

      suricata
    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks