Overview

overview

10

Static

static

cc87e6581c...90.dll

windows7_x64

10

cc87e6581c...90.dll

windows10-2004_x64

10

Resubmissions

17-11-2023 12:47

231117-p1nb6aad8x 10

05-02-2022 09:59

220205-lz81paaddn 10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    cc87e6581ca91f941f65332b2de0e681d58491b54aff9d0b30afae828a5f5790

  • Size

    539KB

  • Sample

    220205-lz81paaddn

  • MD5

    2169e871d4ca668d1872722d1a0695dc

  • SHA1

    add2bbbac042c328ed71c9fd2efcb9cbce5a89f7

  • SHA256

    cc87e6581ca91f941f65332b2de0e681d58491b54aff9d0b30afae828a5f5790

  • SHA512

    fdb93959e88f9cf59be9c515127d02ec41b1370544c23a82b51a49f51b611231e91549a043d7796acef4e95539c75f8a95046b2b31ea0011104a2762b2504c64

Score
10/10
zloaderapr14spambotnetsuricatatrojan

Malware Config

Extracted

Family

zloader

Botnet

Apr14

Campaign

Spam

C2

http://wmwifbajxxbcxmucxmlc.com/post.php

http://ojnxjgfjlftfkkuxxiqd.com/post.php

http://pwkqhdgytsshkoibaake.com/post.php

http://snnmnkxdhflwgthqismb.com/post.php

http://iawfqecrwohcxnhwtofa.com/post.php

http://nlbmfsyplohyaicmxhum.com/post.php

http://fvqlkgedqjiqgapudkgq.com/post.php

http://cmmxhurildiigqghlryq.com/post.php

http://nmqsmbiabjdnuushksas.com/post.php

http://fyratyubvflktyyjiqgq.com/post.php
Attributes
  • build_id

    102

rc4.plain

Targets

    • Target

      cc87e6581ca91f941f65332b2de0e681d58491b54aff9d0b30afae828a5f5790

    • Size

      539KB

    • MD5

      2169e871d4ca668d1872722d1a0695dc

    • SHA1

      add2bbbac042c328ed71c9fd2efcb9cbce5a89f7

    • SHA256

      cc87e6581ca91f941f65332b2de0e681d58491b54aff9d0b30afae828a5f5790

    • SHA512

      fdb93959e88f9cf59be9c515127d02ec41b1370544c23a82b51a49f51b611231e91549a043d7796acef4e95539c75f8a95046b2b31ea0011104a2762b2504c64

    Score
    10/10
    zloaderapr14spambotnettrojansuricata

    • Zloader, Terdot, DELoader, ZeusSphinx

      Zloader is a malware strain that was initially discovered back in August 2015.

      trojanbotnetzloader

    • suricata: ET MALWARE Zbot POST Request to C2

      suricata: ET MALWARE Zbot POST Request to C2

      suricata

    • Blocklisted process makes network request

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks