zloader | 1be04e51510b2aafb51598838b97124a73952c46b17d3d1c38254dd6d94e82a7

General

Target

1be04e51510b2aafb51598838b97124a73952c46b17d3d1c38254dd6d94e82a7
Size

274KB
Sample

220201-mw3j6sdfd6
MD5

11abbd1cd5e968e03b053426b33e64e1
SHA1

7e1bc02b6bc16d4df3f532c8e8498f898ed0acb6
SHA256

1be04e51510b2aafb51598838b97124a73952c46b17d3d1c38254dd6d94e82a7
SHA512

36ef0aa604b36e0e2cdeaded3f4e0593a63747ee80ea114a6ad771d3744c2f56a840148d9b47e7710689d08c8e7f7ffed6d318c99c68b26dcffef8b595e22bc8

Score

10^/10

Malware Config

Extracted

Family

zloader

Botnet

banking

Campaign

banking

C2

https://iloveyoubaby1.pro/gate.php

https://idsakjfsanfaskj.com/gate.php

https://fslakdasjdnsasjsj.com/gate.php

https://dksadjsahnfaskmsa.com/gate.php

https://dskdsajdsahda.info/gate.php

https://dskdsajdsadasda.info/gate.php

https://dskjdsadhsahjsas.info/gate.php

https://dsjadjsadjsadjafsa.info/gate.php

https://fsakjdsafasifkajfaf.pro/gate.php

https://djsadhsadsadjashs.pro/gate.php

Attributes

build_id
3

rc4.plain

Targets

- Target
  
  1be04e51510b2aafb51598838b97124a73952c46b17d3d1c38254dd6d94e82a7
- Size
  
  274KB
- MD5
  
  11abbd1cd5e968e03b053426b33e64e1
- SHA1
  
  7e1bc02b6bc16d4df3f532c8e8498f898ed0acb6
- SHA256
  
  1be04e51510b2aafb51598838b97124a73952c46b17d3d1c38254dd6d94e82a7
- SHA512
  
  36ef0aa604b36e0e2cdeaded3f4e0593a63747ee80ea114a6ad771d3744c2f56a840148d9b47e7710689d08c8e7f7ffed6d318c99c68b26dcffef8b595e22bc8
Score

10^/10

zloader banking banking botnet persistence trojan
- Zloader, Terdot, DELoader, ZeusSphinx
  Zloader is a malware strain that was initially discovered back in August 2015.
  trojan botnet zloader
- Blocklisted process makes network request
- Sets service image path in registry
  persistence
- Adds Run key to start application
  persistence
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

2

T1060

Privilege Escalation

Defense Evasion

Modify Registry

2

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Targets

Zloader, Terdot, DELoader, ZeusSphinx

Blocklisted process makes network request

Sets service image path in registry

Adds Run key to start application

Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v6

Tasks

static1

behavioral1

behavioral2