Extracted

• • Target

    3920ecf9f7dc8f7fe34721ff41f5955b2ed0943eae2031ff602ae92bc6f3b7c5

  • Size

    1.2MB

  • MD5

    8fe28d9e48e7f52c6a7a80c351fa00ee

  • SHA1

    6c137516acc48185f3a916647a729a03f94b09c3

  • SHA256

    3920ecf9f7dc8f7fe34721ff41f5955b2ed0943eae2031ff602ae92bc6f3b7c5

  • SHA512

    6058373532310935ff6b1952a57b512f85e2deee9740e46c3722f0d1adfae23d1471fe3442aa3527ec50bd82815326d0f8fa65845872ff0d4ccd2d0318cb933e

  Score

  10^/10

  zloadermain02.04.2020botnetpersistencetrojan

  • Process spawned unexpected child process

    This typically indicates the parent process was compromised via an exploit or macro.

  • Zloader, Terdot, DELoader, ZeusSphinx

    Zloader is a malware strain that was initially discovered back in August 2015.

    trojanbotnetzloader

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2