Extracted

• • Target

    219594d5b634d5f95904376a1cbd8ecde93b8cdd6cfb785069e51e7eccc78baa

  • Size

    276KB

  • MD5

    0448f77a9999f945a136305716eabe49

  • SHA1

    7d906884962033eb5381fcb018fce79779578584

  • SHA256

    219594d5b634d5f95904376a1cbd8ecde93b8cdd6cfb785069e51e7eccc78baa

  • SHA512

    3270f2a146bf94a5e6981e6d99fde8b9204bb90f5b6b04305261fb6bc10541664bd2f8d6cde290e4296f81c602b649ed6ffc6315c67590506625e59f8263e6db

  Score

  10^/10

  zloaderdllobnovahihiupdatebotnetpersistencesuricatatrojan

  • Zloader, Terdot, DELoader, ZeusSphinx

    Zloader is a malware strain that was initially discovered back in August 2015.

    trojanbotnetzloader

  • suricata: ET MALWARE Generic -POST To gate.php w/Extended ASCII Characters (Likely Zeus Derivative)

    suricata: ET MALWARE Generic -POST To gate.php w/Extended ASCII Characters (Likely Zeus Derivative)

    suricata

  • suricata: ET MALWARE Possible Compromised Host AnubisNetworks Sinkhole Cookie Value Snkz

    suricata: ET MALWARE Possible Compromised Host AnubisNetworks Sinkhole Cookie Value Snkz

    suricata

  • suricata: ET MALWARE Trojan Generic - POST To gate.php with no referer

    suricata: ET MALWARE Trojan Generic - POST To gate.php with no referer

    suricata

  • Blocklisted process makes network request

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2