zloader | 168af6b70609e45a8be1891659d23c70154e940a6fd7f9daf6f8e9bd5192c0c7

Analysis

Target

168af6b70609e45a8be1891659d23c70154e940a6fd7f9daf6f8e9bd5192c0c7.dll
Size

131KB
MD5

28f10a71b6f73e66131efd2278c0b830
SHA1

c7a863d1df81c4995a3ad3f5ec339b1079923fd5
SHA256

168af6b70609e45a8be1891659d23c70154e940a6fd7f9daf6f8e9bd5192c0c7
SHA512

19d66cb8af5852b88ea4f238aea7128733cebde01eb5176c792387359387298d8158642add3fd418cd5ac5e366257bac425c3a36d0ba85efcb3b7b52f139e5be

Score

10^/10

Family

zloader

Botnet

buldog

Campaign

buldog

https://iqowijsdakm.com/gate.php

https://wiewjdmkfjn.com/gate.php

https://dksaoidiakjd.com/gate.php

https://iweuiqjdakjd.com/gate.php

https://yuidskadjna.com/gate.php

https://olksmadnbdj.com/gate.php

https://odsakmdfnbs.com/gate.php

https://odsakjmdnhsaj.com/gate.php

https://odjdnhsaj.com/gate.php

https://odoishsaj.com/gate.php

Attributes

rc4.plain

rsa_pubkey.plain

Zloader, Terdot, DELoader, ZeusSphinx
Zloader is a malware strain that was initially discovered back in August 2015.
trojan botnet zloader
suricata: ET MALWARE Observed ZLoader CnC Domain in SNI
suricata: ET MALWARE Observed ZLoader CnC Domain in SNI
suricata

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 1856 wrote to memory of 2032	1856	rundll32.exe	rundll32.exe
PID 1856 wrote to memory of 2032	1856	rundll32.exe	rundll32.exe
PID 1856 wrote to memory of 2032	1856	rundll32.exe	rundll32.exe
PID 1856 wrote to memory of 2032	1856	rundll32.exe	rundll32.exe
PID 1856 wrote to memory of 2032	1856	rundll32.exe	rundll32.exe
PID 1856 wrote to memory of 2032	1856	rundll32.exe	rundll32.exe
PID 1856 wrote to memory of 2032	1856	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\168af6b70609e45a8be1891659d23c70154e940a6fd7f9daf6f8e9bd5192c0c7.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1856

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\168af6b70609e45a8be1891659d23c70154e940a6fd7f9daf6f8e9bd5192c0c7.dll,#1
2⤵
PID:2032

memory/568-57-0x0000000000090000-0x00000000000B6000-memory.dmp

Filesize
152KB

Download
memory/568-58-0x00000000000C0000-0x00000000000C1000-memory.dmp

Filesize
4KB

Download
memory/568-59-0x0000000000090000-0x00000000000B6000-memory.dmp

Filesize
152KB

Download
memory/568-60-0x0000000000000000-mapping.dmp

Download
memory/568-62-0x0000000000090000-0x00000000000B6000-memory.dmp

Filesize
152KB

Download
memory/2032-55-0x0000000000000000-mapping.dmp

Download
memory/2032-56-0x0000000075881000-0x0000000075883000-memory.dmp

Filesize
8KB

Download