zloader | f0b6c677bac2de611e0866e849cebd64ec5454885fdd7be5bf0c1c5a17846e3a

Analysis

Target

ca.dll
Size

1.7MB
MD5

ca0376cce08c82a5d4c476c4922c4779
SHA1

99644ab0f8d4dde1eb11b7ff88ebd66b21d73f24
SHA256

f0b6c677bac2de611e0866e849cebd64ec5454885fdd7be5bf0c1c5a17846e3a
SHA512

80ad7465be9cfb1e9eabe46e7218c28ffdb71c75b055b9f196f33ac70c3ec80c1e4e9b9ada03d6e4b49415ad1dcea81b2b343df52851f0c2c528131725405813

Score

10^/10

Family

zloader

Botnet

return

Campaign

return

https://asdfghdsajkl.com/gate.php

https://lkjhgfgsdshja.com/gate.php

https://kjdhsasghjds.com/gate.php

https://kdjwhqejqwij.com/gate.php

https://iasudjghnasd.com/gate.php

https://daksjuggdhwa.com/gate.php

https://dkisuaggdjhna.com/gate.php

https://eiqwuggejqw.com/gate.php

https://dquggwjhdmq.com/gate.php

https://djshggadasj.com/gate.php

Attributes

rc4.plain

rsa_pubkey.plain

Zloader, Terdot, DELoader, ZeusSphinx
Zloader is a malware strain that was initially discovered back in August 2015.
trojan botnet zloader

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 3520 wrote to memory of 3996	3520	rundll32.exe	rundll32.exe
PID 3520 wrote to memory of 3996	3520	rundll32.exe	rundll32.exe
PID 3520 wrote to memory of 3996	3520	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\ca.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3520

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\ca.dll,#1
2⤵
PID:3996

memory/1924-121-0x0000000000400000-0x0000000000426000-memory.dmp

Filesize
152KB

Download
memory/1924-122-0x0000000000000000-mapping.dmp

Download
memory/1924-123-0x0000000000100000-0x0000000000101000-memory.dmp

Filesize
4KB

Download
memory/1924-124-0x0000000000100000-0x0000000000101000-memory.dmp

Filesize
4KB

Download
memory/1924-125-0x0000000000400000-0x0000000000426000-memory.dmp

Filesize
152KB

Download
memory/3996-118-0x0000000000000000-mapping.dmp

Download
memory/3996-119-0x00000000001E0000-0x00000000001E1000-memory.dmp

Filesize
4KB

Download
memory/3996-120-0x0000000010000000-0x00000000101C8000-memory.dmp

Filesize
1.8MB

Download