Resubmissions

08-12-2023 09:50

231208-lva8vsad95 10

05-02-2022 10:48

220205-mwes4sagdn 10

General

  • Target

    bc0b57f04efe4239fcc02f049c97016c653c963de8cbe45bcf9449cd16919f08

  • Size

    452KB

  • Sample

    220205-mwes4sagdn

  • MD5

    a87fab5ef51df54563c1752f4cc5b466

  • SHA1

    1e29f9771c034545e618cdb28e12f1004993f8bf

  • SHA256

    bc0b57f04efe4239fcc02f049c97016c653c963de8cbe45bcf9449cd16919f08

  • SHA512

    2369d6b6769853ff7246031bb7081261a6ecc67590e424f2845337291cc0a1241c24fc2ed340deb8f999befa5dea237df2000c5a0bf0f1e410d2394e0735df65

Malware Config

Extracted

Family

zloader

Botnet

goosdoc

Campaign

retcrypt

C2

http://wmwifbajxxbcxmucxmlc.com/post.php

http://pwkqhdgytsshkoibaake.com/post.php

http://snnmnkxdhflwgthqismb.com/post.php

http://iawfqecrwohcxnhwtofa.com/post.php

http://nlbmfsyplohyaicmxhum.com/post.php

http://fvqlkgedqjiqgapudkgq.com/post.php

http://cmmxhurildiigqghlryq.com/post.php

http://nmqsmbiabjdnuushksas.com/post.php

http://fyratyubvflktyyjiqgq.com/post.php

Attributes
  • build_id

    117

rc4.plain

Targets

    • Target

      bc0b57f04efe4239fcc02f049c97016c653c963de8cbe45bcf9449cd16919f08

    • Size

      452KB

    • MD5

      a87fab5ef51df54563c1752f4cc5b466

    • SHA1

      1e29f9771c034545e618cdb28e12f1004993f8bf

    • SHA256

      bc0b57f04efe4239fcc02f049c97016c653c963de8cbe45bcf9449cd16919f08

    • SHA512

      2369d6b6769853ff7246031bb7081261a6ecc67590e424f2845337291cc0a1241c24fc2ed340deb8f999befa5dea237df2000c5a0bf0f1e410d2394e0735df65

    • Zloader, Terdot, DELoader, ZeusSphinx

      Zloader is a malware strain that was initially discovered back in August 2015.

    • Blocklisted process makes network request

    • Suspicious use of SetThreadContext

MITRE ATT&CK Matrix

Tasks