Overview

overview

10

Static

static

e5b440a826...48.dll

windows7_x64

10

e5b440a826...48.dll

windows10-2004_x64

1

Sharing

Copy URL
Twitter E-mail

General

  • Target

    e5b440a826d14744df920514f027f0871f84292d83b95b731eadfe3165117448

  • Size

    873KB

  • Sample

    220205-kn1z9shfe3

  • MD5

    4999aaea3e94b8cebf6f7c85c0e70f87

  • SHA1

    89198a1da32b1aedf70e9a113269b25c0abada82

  • SHA256

    e5b440a826d14744df920514f027f0871f84292d83b95b731eadfe3165117448

  • SHA512

    2cbf48afd27075f2650f78b1f1414f27b0561590e4f142745f7ab326ca29edf22f9b53f1fe127ff9500285a9752ccc9579de525532f417cf3c638a3b5368eec4

Score
10/10
zloadermain05.04.2020botnetpersistencetrojan

Malware Config

Extracted

Family

zloader

Botnet

main

Campaign

05.04.2020

C2

https://knalc.com/sound.php

https://namilh.com/sound.php

https://ronswank.com/sound.php

https://stagolk.com/sound.php

https://mioniough.com/sound.php

https://ergensu.com/sound.php
Attributes
  • build_id

    33

rc4.plain

Targets

    • Target

      e5b440a826d14744df920514f027f0871f84292d83b95b731eadfe3165117448

    • Size

      873KB

    • MD5

      4999aaea3e94b8cebf6f7c85c0e70f87

    • SHA1

      89198a1da32b1aedf70e9a113269b25c0abada82

    • SHA256

      e5b440a826d14744df920514f027f0871f84292d83b95b731eadfe3165117448

    • SHA512

      2cbf48afd27075f2650f78b1f1414f27b0561590e4f142745f7ab326ca29edf22f9b53f1fe127ff9500285a9752ccc9579de525532f417cf3c638a3b5368eec4

    Score
    10/10
    zloadermain05.04.2020botnetpersistencetrojan

    • Zloader, Terdot, DELoader, ZeusSphinx

      Zloader is a malware strain that was initially discovered back in August 2015.

      trojanbotnetzloader

    • Adds Run key to start application

      persistence

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks