zloader | b3cb381f114ec9c163335509a217bbe1c6baa8d2cf5655b5ff84fd8d0a28dc9a

General

Target

b3cb381f114ec9c163335509a217bbe1c6baa8d2cf5655b5ff84fd8d0a28dc9a
Size

257KB
Sample

220201-lejv3acgc2
MD5

5932c1d8e10c2032f9d05da06d1ae299
SHA1

aef4c1c9496c034e17d5917f9754e61a4ba01306
SHA256

b3cb381f114ec9c163335509a217bbe1c6baa8d2cf5655b5ff84fd8d0a28dc9a
SHA512

55eecb201ff082a5ae1a644649931123e725a7621dd607da1a827d2309c4256adf735b5b42a64f4d078843e7d414aacfe8f3a61f478584afac1f1a222282cd68

Score

10^/10

Malware Config

Extracted

Family

zloader

Botnet

DLLobnova

Campaign

mrlapis

C2

https://dsdjfhdsufudhjas.pro/gate.php

https://dsdjfhd9ddksaas.pro/gate.php

https://dsdjfhdsufudhjas.name/gate.php

https://dsdjfhd9ddksaas.com/gate.php

https://dsdjfhdsufudhjas.pw/gate.php

https://dsdjfhd9ddksaas.ru/gate.php

https://dsdjfhdsufudhjas.su/gate.php

https://kdsadisadijdsasm2.com/gate.php

https://dsdjfhdsufudhjas.net/gate.php

https://dsdjfhd9ddksaas.eu/gate.php

Attributes

build_id
8

rc4.plain

rsa_pubkey.plain

Targets

- Target
  
  b3cb381f114ec9c163335509a217bbe1c6baa8d2cf5655b5ff84fd8d0a28dc9a
- Size
  
  257KB
- MD5
  
  5932c1d8e10c2032f9d05da06d1ae299
- SHA1
  
  aef4c1c9496c034e17d5917f9754e61a4ba01306
- SHA256
  
  b3cb381f114ec9c163335509a217bbe1c6baa8d2cf5655b5ff84fd8d0a28dc9a
- SHA512
  
  55eecb201ff082a5ae1a644649931123e725a7621dd607da1a827d2309c4256adf735b5b42a64f4d078843e7d414aacfe8f3a61f478584afac1f1a222282cd68
Score

10^/10

zloader dllobnova mrlapis botnet persistence trojan
- Zloader, Terdot, DELoader, ZeusSphinx
  Zloader is a malware strain that was initially discovered back in August 2015.
  trojan botnet zloader
- Adds Run key to start application
  persistence
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Targets

Zloader, Terdot, DELoader, ZeusSphinx

Adds Run key to start application

Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v6

Tasks

static1

behavioral1

behavioral2