Overview

overview

10

Static

static

14c47cc16c...e8.dll

windows7_x64

10

14c47cc16c...e8.dll

windows10-2004_x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    14c47cc16c55060409202302048d8b8f97c9b3fa462d7710ab91bb3f3f7a75e8
  • Size 370KB
  • Sample220309-c7rlyafcfl
  • SHA256 14c47cc16c55060409202302048d8b8f97c9b3fa462d7710ab91bb3f3f7a75e8
  • MD5 SHA1 SHA512
Score
10/10
zloadernut30/11botnetsuricatatrojan

Malware Config

Extracted

Family

  • zloader

Botnet

  • nut

Campaign

  • 30/11

C2

  • https://aogmphregion.org.za/construction.php

  • https://aayanent.com/backups.php

  • https://eagle-family.co.uk/panel.php

  • https://khanbuilders.uk/wp-punch.php

  • https://construbienesjg.com/wp-punch.php

  • https://despautyajobssooka.ml/wp-smarts.php

Attributes
  • build_id

    257

rc4.plain
rsa_pubkey.plain

Targets

    • Target
      14c47cc16c55060409202302048d8b8f97c9b3fa462d7710ab91bb3f3f7a75e8
    • Size 370KB
    • SHA256 14c47cc16c55060409202302048d8b8f97c9b3fa462d7710ab91bb3f3f7a75e8
    • MD5 SHA1 SHA512
    Score
    10/10
    zloadernut30/11botnettrojansuricata

    • Zloader, Terdot, DELoader, ZeusSphinx

      Zloader is a malware strain that was initially discovered back in August 2015.

      trojanbotnetzloader

    • suricata: ET MALWARE Zbot POST Request to C2

      suricata: ET MALWARE Zbot POST Request to C2

      suricata

    • Blocklisted process makes network request

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks