Resubmissions

08-12-2023 09:45

231208-lrje3aad83 10

05-02-2022 16:42

220205-t7syfadda8 10

General

  • Target

    3b4b2c5c8a00fab59684fee37b54912c58682022e2dc4e3dcd24b6e58533ecd9

  • Size

    421KB

  • Sample

    220205-t7syfadda8

  • MD5

    061506b2a0a26fbd20dba69a1105e1b7

  • SHA1

    a4f4bc27be3da2b85a06883615bb96b8a2a79ebb

  • SHA256

    3b4b2c5c8a00fab59684fee37b54912c58682022e2dc4e3dcd24b6e58533ecd9

  • SHA512

    4426c072cb52f2e4ce35ca88c4f20304145d017b5e95f2d35aa68216691b6abde99b6941e1067e50b77342300dea329cb0facbc5ab391272ced658dcf5ee2be9

Malware Config

Extracted

Family

zloader

Botnet

April23Fixed

Campaign

April23Fixed

C2

http://wmwifbajxxbcxmucxmlc.com/post.php

http://onfovdaqqrwbvdfoqnof.com/post.php

http://cmmxhurildiigqghlryq.com/post.php

http://nmqsmbiabjdnuushksas.com/post.php

http://fvqlkgedqjiqgapudkgq.com/post.php

http://iawfqecrwohcxnhwtofa.com/post.php

http://nlbmfsyplohyaicmxhum.com/post.php

http://snnmnkxdhflwgthqismb.com/post.php

Attributes
  • build_id

    120

rc4.plain

Targets

    • Target

      3b4b2c5c8a00fab59684fee37b54912c58682022e2dc4e3dcd24b6e58533ecd9

    • Size

      421KB

    • MD5

      061506b2a0a26fbd20dba69a1105e1b7

    • SHA1

      a4f4bc27be3da2b85a06883615bb96b8a2a79ebb

    • SHA256

      3b4b2c5c8a00fab59684fee37b54912c58682022e2dc4e3dcd24b6e58533ecd9

    • SHA512

      4426c072cb52f2e4ce35ca88c4f20304145d017b5e95f2d35aa68216691b6abde99b6941e1067e50b77342300dea329cb0facbc5ab391272ced658dcf5ee2be9

    • Zloader, Terdot, DELoader, ZeusSphinx

      Zloader is a malware strain that was initially discovered back in August 2015.

    • Blocklisted process makes network request

    • Suspicious use of SetThreadContext

MITRE ATT&CK Matrix

Tasks