zloader | bb33e0b91b1b38802b2bfd5654d3888dee17959c6f07d3ce67dbac278712a402

General

Target

bb33e0b91b1b38802b2bfd5654d3888dee17959c6f07d3ce67dbac278712a402
Size

303KB
Sample

220201-lb8p1scfg4
MD5

1174bedf6bd31b666e5c82166d2ec763
SHA1

1a1e6d5f8e024ea29aa6e77f8a7d68c554d16895
SHA256

bb33e0b91b1b38802b2bfd5654d3888dee17959c6f07d3ce67dbac278712a402
SHA512

d33f2901c7121de80bbb937304ba2215c24c7a8201aede9dda5fa18920491552bb85ec0625713f0e71a874dd38049f5369d064f82400a71eeeebeeb8cd8b4b0f

Score

10^/10

Malware Config

Extracted

Family

zloader

Botnet

DLLobnova

Campaign

alisa

C2

https://dsdjfhdsufudhjas.pro/gate.php

https://dsdjfhd9ddksaas.pro/gate.php

https://dsdjfhdsufudhjas.name/gate.php

https://dsdjfhd9ddksaas.com/gate.php

https://dsdjfhdsufudhjas.pw/gate.php

https://dsdjfhd9ddksaas.ru/gate.php

https://dsdjfhdsufudhjas.su/gate.php

https://kdsadisadijdsasm2.com/gate.php

https://dsdjfhdsufudhjas.net/gate.php

https://dsdjfhd9ddksaas.eu/gate.php

Attributes

build_id
4

rc4.plain

rsa_pubkey.plain

Targets

- Target
  
  bb33e0b91b1b38802b2bfd5654d3888dee17959c6f07d3ce67dbac278712a402
- Size
  
  303KB
- MD5
  
  1174bedf6bd31b666e5c82166d2ec763
- SHA1
  
  1a1e6d5f8e024ea29aa6e77f8a7d68c554d16895
- SHA256
  
  bb33e0b91b1b38802b2bfd5654d3888dee17959c6f07d3ce67dbac278712a402
- SHA512
  
  d33f2901c7121de80bbb937304ba2215c24c7a8201aede9dda5fa18920491552bb85ec0625713f0e71a874dd38049f5369d064f82400a71eeeebeeb8cd8b4b0f
Score

10^/10

zloader dllobnova alisa botnet persistence trojan
- Zloader, Terdot, DELoader, ZeusSphinx
  Zloader is a malware strain that was initially discovered back in August 2015.
  trojan botnet zloader
- Sets service image path in registry
  persistence
- Adds Run key to start application
  persistence
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

2

T1060

Privilege Escalation

Defense Evasion

Modify Registry

2

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Targets

Zloader, Terdot, DELoader, ZeusSphinx

Sets service image path in registry

Adds Run key to start application

Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v6

Tasks

static1

behavioral1

behavioral2