Overview

overview

10

Static

static

161dabd778...5e.dll

windows7_x64

10

161dabd778...5e.dll

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    161dabd778b2d24a7cae425bc2349e3db840acf49222c6067359ec7a01d3e05e

  • Size

    258KB

  • Sample

    220201-myk3xadfe8

  • MD5

    b57d728b9b71593edb74984985412ebd

  • SHA1

    71394a1e2056ab7938d00d65ea4e74fb92178630

  • SHA256

    161dabd778b2d24a7cae425bc2349e3db840acf49222c6067359ec7a01d3e05e

  • SHA512

    c277df221bbd76884468d499c0a9fdff8443efd2e2540f56678f6d8831e315c27d3f51d6129344652daffa215a6f4e63915f7665bbe487a5a1f4dfbd3bcb26a4

Score
10/10
zloaderbankingbankingbotnetpersistencetrojan

Malware Config

Extracted

Family

zloader

Botnet

banking

Campaign

banking

C2

https://iloveyoubaby1.pro/gate.php

https://idsakjfsanfaskj.com/gate.php

https://fslakdasjdnsasjsj.com/gate.php

https://dksadjsahnfaskmsa.com/gate.php

https://dskdsajdsahda.info/gate.php

https://dskdsajdsadasda.info/gate.php

https://dskjdsadhsahjsas.info/gate.php

https://dsjadjsadjsadjafsa.info/gate.php

https://fsakjdsafasifkajfaf.pro/gate.php

https://djsadhsadsadjashs.pro/gate.php
Attributes
  • build_id

    2

rc4.plain

Targets

    • Target

      161dabd778b2d24a7cae425bc2349e3db840acf49222c6067359ec7a01d3e05e

    • Size

      258KB

    • MD5

      b57d728b9b71593edb74984985412ebd

    • SHA1

      71394a1e2056ab7938d00d65ea4e74fb92178630

    • SHA256

      161dabd778b2d24a7cae425bc2349e3db840acf49222c6067359ec7a01d3e05e

    • SHA512

      c277df221bbd76884468d499c0a9fdff8443efd2e2540f56678f6d8831e315c27d3f51d6129344652daffa215a6f4e63915f7665bbe487a5a1f4dfbd3bcb26a4

    Score
    10/10
    zloaderbankingbankingbotnetpersistencetrojan

    • Suspicious use of NtCreateProcessExOtherParentProcess

    • Zloader, Terdot, DELoader, ZeusSphinx

      Zloader is a malware strain that was initially discovered back in August 2015.

      trojanbotnetzloader

    • Blocklisted process makes network request

    • Sets service image path in registry

      persistence

    • Adds Run key to start application

      persistence

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

2
T1060

Privilege Escalation

Defense Evasion

Modify Registry

2
T1112

Credential Access

Discovery

System Information Discovery

3
T1082

Query Registry

2
T1012

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks