zloader | af6af9c2d50e7c692521dac219b7f2f23c6b677216267dcbaf44bd44f7290d70 | Triage

Sharing

General

Target

af6af9c2d50e7c692521dac219b7f2f23c6b677216267dcbaf44bd44f7290d70
Size

830KB
Sample

220201-e5cfcagffr
MD5

05df30ff372ff1d27ab4874b50565c8f
SHA1

e5e16ba4f24fd939e6ece581704ac6ca9df4b0d6
SHA256

af6af9c2d50e7c692521dac219b7f2f23c6b677216267dcbaf44bd44f7290d70
SHA512

ff152d5327fe7c3abeed6f74c3f5173de8bb228b6207036d9bc086eaeb164781118b6eb2fbae648ad06c59f862c902b8735099d63022dd661f6e5183631b97f8

Score

10^/10

zloader main 23.03.2020 botnet persistence trojan

Malware Config

Extracted

Family

zloader

Botnet

main

Campaign

23.03.2020

C2

https://hustlertest.com/sound.php

https://dandycodes.com/sound.php

https://sandyfotos.com/sound.php

Attributes

build_id
26

rc4.plain

Targets

- Target
  
  af6af9c2d50e7c692521dac219b7f2f23c6b677216267dcbaf44bd44f7290d70
- Size
  
  830KB
- MD5
  
  05df30ff372ff1d27ab4874b50565c8f
- SHA1
  
  e5e16ba4f24fd939e6ece581704ac6ca9df4b0d6
- SHA256
  
  af6af9c2d50e7c692521dac219b7f2f23c6b677216267dcbaf44bd44f7290d70
- SHA512
  
  ff152d5327fe7c3abeed6f74c3f5173de8bb228b6207036d9bc086eaeb164781118b6eb2fbae648ad06c59f862c902b8735099d63022dd661f6e5183631b97f8
Score

10^/10

zloader main 23.03.2020 botnet persistence trojan
- Zloader, Terdot, DELoader, ZeusSphinx
  Zloader is a malware strain that was initially discovered back in August 2015.
  trojan botnet zloader
- Sets service image path in registry
  persistence
- Adds Run key to start application
  persistence
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

Privilege Escalation

Defense Evasion

Modify Registry

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks

static1

behavioral1

zloadermain23.03.2020botnetpersistencetrojan

behavioral2

zloadermain23.03.2020botnetpersistencetrojan