zloader | ca4214e15181e52923f713771455f5709e4baa13626cad85b735734cf66d36db

General

Target

ca4214e15181e52923f713771455f5709e4baa13626cad85b735734cf66d36db
Size

281KB
Sample

220201-k7s4rscfa2
MD5

f3362eae787c09d8061194591dee0727
SHA1

cc5fe51c5b35dcef50b5adfc730b1354ae124bab
SHA256

ca4214e15181e52923f713771455f5709e4baa13626cad85b735734cf66d36db
SHA512

e0ba969db9b0c217c25246695186b53734a4e502765f73d018f91480cc2120fe2472c3a9931bbee998660afd558c54a79b81a80ab32ae59115107084ab7d0de0

Score

10^/10

Malware Config

Extracted

Family

zloader

Botnet

DLLobnova

Campaign

prodomains

C2

https://dsdjfhdsufudhjas.pro/gate.php

https://dsdjfhd9ddksaas.pro/gate.php

https://dsdjfhdsufudhjas.name/gate.php

https://dsdjfhd9ddksaas.com/gate.php

https://dsdjfhdsufudhjas.pw/gate.php

https://dsdjfhd9ddksaas.ru/gate.php

https://dsdjfhdsufudhjas.su/gate.php

https://kdsadisadijdsasm2.com/gate.php

https://dsdjfhdsufudhjas.net/gate.php

https://dsdjfhd9ddksaas.eu/gate.php

Attributes

build_id
27

rc4.plain

Targets

- Target
  
  ca4214e15181e52923f713771455f5709e4baa13626cad85b735734cf66d36db
- Size
  
  281KB
- MD5
  
  f3362eae787c09d8061194591dee0727
- SHA1
  
  cc5fe51c5b35dcef50b5adfc730b1354ae124bab
- SHA256
  
  ca4214e15181e52923f713771455f5709e4baa13626cad85b735734cf66d36db
- SHA512
  
  e0ba969db9b0c217c25246695186b53734a4e502765f73d018f91480cc2120fe2472c3a9931bbee998660afd558c54a79b81a80ab32ae59115107084ab7d0de0
Score

10^/10

zloader dllobnova prodomains botnet persistence trojan
- Zloader, Terdot, DELoader, ZeusSphinx
  Zloader is a malware strain that was initially discovered back in August 2015.
  trojan botnet zloader
- Adds Run key to start application
  persistence
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Targets

Zloader, Terdot, DELoader, ZeusSphinx

Adds Run key to start application

Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v6

Tasks

static1

behavioral1

behavioral2