General

  • Target

    7556a3160ba28ac50418bb9989de2f83a5dfc54376a43500d16db7c3c76c04d4

  • Size

    274KB

  • Sample

    220201-l4xhfscehm

  • MD5

    93b92d3e5ac8fa4c1e57dace11d95b6e

  • SHA1

    5f4141f7ea51c279c4eff39dddc59c182bdf400a

  • SHA256

    7556a3160ba28ac50418bb9989de2f83a5dfc54376a43500d16db7c3c76c04d4

  • SHA512

    b4279f10458e87c21d155aff3f41cb4809043e7d20cebc10f178fd47649a23318c46dbda7136fc6ea5ea15dd7dc7cb3a627312cbb827a7b9b2ddda7b5b019bc6

Malware Config

Extracted

Family

zloader

Botnet

DLLobnova

Campaign

ogneniyupdate

C2

https://fdsjfjdsfjdsdsjajjs.com/gate.php

https://idisaudhasdhasdj.com/gate.php

https://dsjdjsjdsadhasdas.com/gate.php

https://dsdjfhdsufudhjas.com/gate.php

https://dsdjfhdsufudhjas.info/gate.php

https://fdsjfjdsfjdsdsjajjs.info/gate.php

https://idisaudhasdhasdj.info/gate.php

https://dsdjfhdsufudhjas.pro/gate.php

https://dsdjfhd9ddksaas.pro/gate.php

Attributes
  • build_id

    17

rc4.plain

Targets

    • Target

      7556a3160ba28ac50418bb9989de2f83a5dfc54376a43500d16db7c3c76c04d4

    • Size

      274KB

    • MD5

      93b92d3e5ac8fa4c1e57dace11d95b6e

    • SHA1

      5f4141f7ea51c279c4eff39dddc59c182bdf400a

    • SHA256

      7556a3160ba28ac50418bb9989de2f83a5dfc54376a43500d16db7c3c76c04d4

    • SHA512

      b4279f10458e87c21d155aff3f41cb4809043e7d20cebc10f178fd47649a23318c46dbda7136fc6ea5ea15dd7dc7cb3a627312cbb827a7b9b2ddda7b5b019bc6

    • Zloader, Terdot, DELoader, ZeusSphinx

      Zloader is a malware strain that was initially discovered back in August 2015.

    • suricata: ET MALWARE Generic -POST To gate.php w/Extended ASCII Characters (Likely Zeus Derivative)

      suricata: ET MALWARE Generic -POST To gate.php w/Extended ASCII Characters (Likely Zeus Derivative)

    • suricata: ET MALWARE Possible Compromised Host AnubisNetworks Sinkhole Cookie Value Snkz

      suricata: ET MALWARE Possible Compromised Host AnubisNetworks Sinkhole Cookie Value Snkz

    • suricata: ET MALWARE Trojan Generic - POST To gate.php with no referer

      suricata: ET MALWARE Trojan Generic - POST To gate.php with no referer

    • suricata: ET MALWARE Zbot POST Request to C2

      suricata: ET MALWARE Zbot POST Request to C2

    • Blocklisted process makes network request

    • Sets service image path in registry

    • Adds Run key to start application

    • Suspicious use of SetThreadContext

MITRE ATT&CK Matrix ATT&CK v6

Persistence

Registry Run Keys / Startup Folder

2
T1060

Defense Evasion

Modify Registry

2
T1112

Tasks