Overview

overview

10

Static

static

be3d1522f9...45.dll

windows7_x64

10

be3d1522f9...45.dll

windows10-2004_x64

10

Resubmissions

08-12-2023 09:55

231208-lx8bdaae24 10

05-02-2022 10:42

220205-mrwwtsagan 10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    be3d1522f968ad7cc46a996a64b5e5be8044075f6bd1784046e46671bf416b45

  • Size

    472KB

  • Sample

    220205-mrwwtsagan

  • MD5

    f500b424c560f00ccd993a46e4b9fcfa

  • SHA1

    d1da2bb6a020462d5d7ac6301395e10d2acb6b17

  • SHA256

    be3d1522f968ad7cc46a996a64b5e5be8044075f6bd1784046e46671bf416b45

  • SHA512

    65018b4c441db4b618a988cb6d9fa46bcfd2754af244e9d1d309295ba1d2477dd1ea6609214bc7d725b3576b4232c81fa260873357652b89529f0dabd6fd14d0

Score
10/10
zloaderapril24mishaapril24mishabotnetsuricatatrojan

Malware Config

Extracted

Family

zloader

Botnet

April24misha

Campaign

April24misha

C2

http://wmwifbajxxbcxmucxmlc.com/post.php

http://onfovdaqqrwbvdfoqnof.com/post.php

http://cmmxhurildiigqghlryq.com/post.php

http://nmqsmbiabjdnuushksas.com/post.php

http://fvqlkgedqjiqgapudkgq.com/post.php

http://iawfqecrwohcxnhwtofa.com/post.php

http://nlbmfsyplohyaicmxhum.com/post.php

http://snnmnkxdhflwgthqismb.com/post.php
Attributes
  • build_id

    122

rc4.plain

Targets

    • Target

      be3d1522f968ad7cc46a996a64b5e5be8044075f6bd1784046e46671bf416b45

    • Size

      472KB

    • MD5

      f500b424c560f00ccd993a46e4b9fcfa

    • SHA1

      d1da2bb6a020462d5d7ac6301395e10d2acb6b17

    • SHA256

      be3d1522f968ad7cc46a996a64b5e5be8044075f6bd1784046e46671bf416b45

    • SHA512

      65018b4c441db4b618a988cb6d9fa46bcfd2754af244e9d1d309295ba1d2477dd1ea6609214bc7d725b3576b4232c81fa260873357652b89529f0dabd6fd14d0

    Score
    10/10
    zloaderapril24mishaapril24mishabotnetsuricatatrojan

    • Zloader, Terdot, DELoader, ZeusSphinx

      Zloader is a malware strain that was initially discovered back in August 2015.

      trojanbotnetzloader

    • suricata: ET MALWARE Possible Compromised Host AnubisNetworks Sinkhole Cookie Value Snkz

      suricata: ET MALWARE Possible Compromised Host AnubisNetworks Sinkhole Cookie Value Snkz

      suricata

    • Blocklisted process makes network request

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1
T1012

System Information Discovery

1
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks