zloader | dd11381223ab1902db2963df4cbe3299e42064a5857545560f913647c1f70c5a | Triage

Sharing

General

Target

dd11381223ab1902db2963df4cbe3299e42064a5857545560f913647c1f70c5a
Size

187KB
Sample

220205-k4nd4shgh6
MD5

133b1861b3590bf00308509227f82872
SHA1

eb6f12759da7aa84077143e3e2694b6fda3d5631
SHA256

dd11381223ab1902db2963df4cbe3299e42064a5857545560f913647c1f70c5a
SHA512

f541c46522cd6aaf52983fd8f28798550416aedd984b9de139521e89094db06a112add90079dec18b0eb0f90a556451d820bde8081af8eee6f676a0f6a260b34

Score

10^/10

zloader miguel 20/04 botnet persistence trojan

Malware Config

Extracted

Family

zloader

Botnet

miguel

Campaign

20/04

C2

https://dcaiqjgnbt.icu/wp-config.php

https://nmttxggtb.press/wp-config.php

Attributes

build_id
165

rc4.plain

Targets

- Target
  
  dd11381223ab1902db2963df4cbe3299e42064a5857545560f913647c1f70c5a
- Size
  
  187KB
- MD5
  
  133b1861b3590bf00308509227f82872
- SHA1
  
  eb6f12759da7aa84077143e3e2694b6fda3d5631
- SHA256
  
  dd11381223ab1902db2963df4cbe3299e42064a5857545560f913647c1f70c5a
- SHA512
  
  f541c46522cd6aaf52983fd8f28798550416aedd984b9de139521e89094db06a112add90079dec18b0eb0f90a556451d820bde8081af8eee6f676a0f6a260b34
Score

10^/10

zloader miguel 20/04 botnet trojan persistence
- Zloader, Terdot, DELoader, ZeusSphinx
  Zloader is a malware strain that was initially discovered back in August 2015.
  trojan botnet zloader
- Sets service image path in registry
  persistence
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

Privilege Escalation

Defense Evasion

Modify Registry

Credential Access

Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks

static1

miguel20/04zloader

behavioral1

zloadermiguel20/04botnettrojan

behavioral2

zloadermiguel20/04botnetpersistencetrojan