Extracted

• • Target

    7556a3160ba28ac50418bb9989de2f83a5dfc54376a43500d16db7c3c76c04d4

  • Size

    274KB

  • MD5

    93b92d3e5ac8fa4c1e57dace11d95b6e

  • SHA1

    5f4141f7ea51c279c4eff39dddc59c182bdf400a

  • SHA256

    7556a3160ba28ac50418bb9989de2f83a5dfc54376a43500d16db7c3c76c04d4

  • SHA512

    b4279f10458e87c21d155aff3f41cb4809043e7d20cebc10f178fd47649a23318c46dbda7136fc6ea5ea15dd7dc7cb3a627312cbb827a7b9b2ddda7b5b019bc6

  Score

  10^/10

  zloaderdllobnovaogneniyupdatebotnetpersistencesuricatatrojan

  • Zloader, Terdot, DELoader, ZeusSphinx

    Zloader is a malware strain that was initially discovered back in August 2015.

    trojanbotnetzloader

  • suricata: ET MALWARE Generic -POST To gate.php w/Extended ASCII Characters (Likely Zeus Derivative)

    suricata: ET MALWARE Generic -POST To gate.php w/Extended ASCII Characters (Likely Zeus Derivative)

    suricata

  • suricata: ET MALWARE Possible Compromised Host AnubisNetworks Sinkhole Cookie Value Snkz

    suricata: ET MALWARE Possible Compromised Host AnubisNetworks Sinkhole Cookie Value Snkz

    suricata

  • suricata: ET MALWARE Trojan Generic - POST To gate.php with no referer

    suricata: ET MALWARE Trojan Generic - POST To gate.php with no referer

    suricata

  • suricata: ET MALWARE Zbot POST Request to C2

    suricata: ET MALWARE Zbot POST Request to C2

    suricata

  • Blocklisted process makes network request

  • Sets service image path in registry

    persistence

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2