General

  • Target

    219594d5b634d5f95904376a1cbd8ecde93b8cdd6cfb785069e51e7eccc78baa

  • Size

    276KB

  • Sample

    220201-mtzqhadbcm

  • MD5

    0448f77a9999f945a136305716eabe49

  • SHA1

    7d906884962033eb5381fcb018fce79779578584

  • SHA256

    219594d5b634d5f95904376a1cbd8ecde93b8cdd6cfb785069e51e7eccc78baa

  • SHA512

    3270f2a146bf94a5e6981e6d99fde8b9204bb90f5b6b04305261fb6bc10541664bd2f8d6cde290e4296f81c602b649ed6ffc6315c67590506625e59f8263e6db

Malware Config

Extracted

Family

zloader

Botnet

DLLobnova

Campaign

hihiupdate

C2

https://fdsjfjdsfjdsdsjajjs.com/gate.php

https://idisaudhasdhasdj.com/gate.php

https://dsjdjsjdsadhasdas.com/gate.php

https://dsdjfhdsufudhjas.com/gate.php

https://dsdjfhdsufudhjas.info/gate.php

https://fdsjfjdsfjdsdsjajjs.info/gate.php

https://idisaudhasdhasdj.info/gate.php

https://dsdjfhdsufudhjas.pro/gate.php

https://dsdjfhd9ddksaas.pro/gate.php

Attributes
  • build_id

    7

rc4.plain

Targets

    • Target

      219594d5b634d5f95904376a1cbd8ecde93b8cdd6cfb785069e51e7eccc78baa

    • Size

      276KB

    • MD5

      0448f77a9999f945a136305716eabe49

    • SHA1

      7d906884962033eb5381fcb018fce79779578584

    • SHA256

      219594d5b634d5f95904376a1cbd8ecde93b8cdd6cfb785069e51e7eccc78baa

    • SHA512

      3270f2a146bf94a5e6981e6d99fde8b9204bb90f5b6b04305261fb6bc10541664bd2f8d6cde290e4296f81c602b649ed6ffc6315c67590506625e59f8263e6db

    • Zloader, Terdot, DELoader, ZeusSphinx

      Zloader is a malware strain that was initially discovered back in August 2015.

    • suricata: ET MALWARE Generic -POST To gate.php w/Extended ASCII Characters (Likely Zeus Derivative)

      suricata: ET MALWARE Generic -POST To gate.php w/Extended ASCII Characters (Likely Zeus Derivative)

    • suricata: ET MALWARE Possible Compromised Host AnubisNetworks Sinkhole Cookie Value Snkz

      suricata: ET MALWARE Possible Compromised Host AnubisNetworks Sinkhole Cookie Value Snkz

    • suricata: ET MALWARE Trojan Generic - POST To gate.php with no referer

      suricata: ET MALWARE Trojan Generic - POST To gate.php with no referer

    • Blocklisted process makes network request

    • Adds Run key to start application

    • Suspicious use of SetThreadContext

MITRE ATT&CK Matrix ATT&CK v6

Persistence

Registry Run Keys / Startup Folder

1
T1060

Defense Evasion

Modify Registry

1
T1112

Tasks