Overview

overview

10

Static

static

0a529a4059...e8.dll

windows7_x64

10

0a529a4059...e8.dll

windows10-2004_x64

1

Sharing

Copy URL
Twitter E-mail

General

  • Target

    0a529a4059586c60a025c4f646c6ca443488a39263f5f21b897fe7f9373602e8

  • Size

    854KB

  • Sample

    220205-yfcjlaehhm

  • MD5

    19e408f81cf26358f32010d0e8de00df

  • SHA1

    31361849ff0cc6b9fecc7489462bb683d0f2af49

  • SHA256

    0a529a4059586c60a025c4f646c6ca443488a39263f5f21b897fe7f9373602e8

  • SHA512

    55be375f7a50d5ba319a9919ba7faf7f847c1e9164c973ddc77a504fbda9569e3c911c566e8719f3b237753bee41757477db20b6cd413953c356862a0a621220

Score
10/10
zloadermain09.04.2020botnetpersistencetrojan

Malware Config

Extracted

Family

zloader

Botnet

main

Campaign

09.04.2020

C2

https://vacontd.com/sound.php

https://zelacarths.com/sound.php

https://bluslias.com/sound.php

https://adandore.com/sound.php

https://ficutept.com/sound.php

https://veckeard.com/sound.php
Attributes
  • build_id

    35

rc4.plain

Targets

    • Target

      0a529a4059586c60a025c4f646c6ca443488a39263f5f21b897fe7f9373602e8

    • Size

      854KB

    • MD5

      19e408f81cf26358f32010d0e8de00df

    • SHA1

      31361849ff0cc6b9fecc7489462bb683d0f2af49

    • SHA256

      0a529a4059586c60a025c4f646c6ca443488a39263f5f21b897fe7f9373602e8

    • SHA512

      55be375f7a50d5ba319a9919ba7faf7f847c1e9164c973ddc77a504fbda9569e3c911c566e8719f3b237753bee41757477db20b6cd413953c356862a0a621220

    Score
    10/10
    zloadermain09.04.2020botnetpersistencetrojan

    • Zloader, Terdot, DELoader, ZeusSphinx

      Zloader is a malware strain that was initially discovered back in August 2015.

      trojanbotnetzloader

    • Adds Run key to start application

      persistence

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks