Extracted

• • Target

    attachment-2

  • Size

    596B

  • MD5

    75afa754580eb8ff885b9d57c7e04fb6

  • SHA1

    2b3649f301c0b045fa289d90996ac061ecbfd5dd

  • SHA256

    4760aeaf2e330be98a7396c222bf5b8a5833b1227e0246f80015e1b865f515a1

  • SHA512

    2c8f0e26da5ca9806fb792ca032625484a9d2ca1a5206b06ba834aa0531e677cf0d8cf34eaab05c193bf7922bd51363b9801fc6426bc8c7a9c4a74d8f2a586eb

  Score

  8^/10

  persistence

  • Sets service image path in registry

    persistence
  behavioral1behavioral2

• • Target

    nzcukv_04537951.vbs

  • Size

    1.6MB

  • MD5

    984dd8740ae65dcc429e50928d0eef54

  • SHA1

    06a0a1a8c514ec9788a23cf5cbab77feef7d9386

  • SHA256

    d9315d5ec377dd1302291eba02fb6e7c036631b5b408eb48a432a229c2dcfda9

  • SHA512

    81ad586312d3931a211131e1d6f473004e15bd047a14e1f8237a128f85d9509a2090258741936e6c59d55c667cad2f4b625a929d5e9abd18677cf2887d35c851

  Score

  10^/10

  zloadermain2020-06-07botnettrojan

  • Process spawned unexpected child process

    This typically indicates the parent process was compromised via an exploit or macro.

  • Zloader, Terdot, DELoader, ZeusSphinx

    Zloader is a malware strain that was initially discovered back in August 2015.

    trojanbotnetzloader

  • Blocklisted process makes network request

  • Deletes itself

  • Loads dropped DLL

  • Legitimate hosting services abused for malware hosting/C2

  • Suspicious use of SetThreadContext

  behavioral3behavioral4