General
- Target 835048e00ba3babf6f920c9a4c2863865a5dcf8e0b6ede4f57c63aeb9cb5c147
- Size 184KB
- Sample220205-qtgrgabgg4
- SHA256 835048e00ba3babf6f920c9a4c2863865a5dcf8e0b6ede4f57c63aeb9cb5c147
Score
10/10
Malware Config
Extracted
Family
-
zloader
Botnet
-
TelegramCrypt
Campaign
-
AntiAMSIdoc
C2
-
http://wmwifbajxxbcxmucxmlc.com/post.php
-
http://pwkqhdgytsshkoibaake.com/post.php
-
http://snnmnkxdhflwgthqismb.com/post.php
-
http://iawfqecrwohcxnhwtofa.com/post.php
-
http://nlbmfsyplohyaicmxhum.com/post.php
-
http://fvqlkgedqjiqgapudkgq.com/post.php
-
http://cmmxhurildiigqghlryq.com/post.php
-
http://nmqsmbiabjdnuushksas.com/post.php
-
http://fyratyubvflktyyjiqgq.com/post.php
Attributes
-
build_id
115
rc4.plain
Targets
-
- Target 835048e00ba3babf6f920c9a4c2863865a5dcf8e0b6ede4f57c63aeb9cb5c147
- Size 184KB
- SHA256 835048e00ba3babf6f920c9a4c2863865a5dcf8e0b6ede4f57c63aeb9cb5c147
Score10/10-
Zloader, Terdot, DELoader, ZeusSphinx
Zloader is a malware strain that was initially discovered back in August 2015.
-
Blocklisted process makes network request
-
Suspicious use of SetThreadContext