Overview

overview

10

Static

static

f7310ec9aa...40.dll

windows7_x64

10

f7310ec9aa...40.dll

windows10-2004_x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    f7310ec9aae872399d2543df307f7935360bd20fca323eabf85ab0a349ee9d40
  • Size 370KB
  • Sample220309-c7mb8afcfj
  • SHA256 f7310ec9aae872399d2543df307f7935360bd20fca323eabf85ab0a349ee9d40
  • MD5 SHA1 SHA512
Score
10/10
zloadernut30/11botnetsuricatatrojan

Malware Config

Extracted

Family

  • zloader

Botnet

  • nut

Campaign

  • 30/11

C2

  • https://aogmphregion.org.za/construction.php

  • https://aayanent.com/backups.php

  • https://eagle-family.co.uk/panel.php

  • https://khanbuilders.uk/wp-punch.php

  • https://construbienesjg.com/wp-punch.php

  • https://despautyajobssooka.ml/wp-smarts.php

Attributes
  • build_id

    257

rc4.plain
rsa_pubkey.plain

Targets

    • Target
      f7310ec9aae872399d2543df307f7935360bd20fca323eabf85ab0a349ee9d40
    • Size 370KB
    • SHA256 f7310ec9aae872399d2543df307f7935360bd20fca323eabf85ab0a349ee9d40
    • MD5 SHA1 SHA512
    Score
    10/10
    zloadernut30/11botnettrojansuricata

    • Zloader, Terdot, DELoader, ZeusSphinx

      Zloader is a malware strain that was initially discovered back in August 2015.

      trojanbotnetzloader

    • suricata: ET MALWARE Zbot POST Request to C2

      suricata: ET MALWARE Zbot POST Request to C2

      suricata

    • Blocklisted process makes network request

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks