zloader | a08fa77833ace89dbc789d804f9f5632fec0b64a301567e07f495e98c33bee42

Analysis

Target

a08fa77833ace89dbc789d804f9f5632fec0b64a301567e07f495e98c33bee42.dll
Size

437KB
MD5

afe7a69ba07d6d8c7779b8d99277a87c
SHA1

fa203f36e976c3ef1fbad3c9b5a55117497e5768
SHA256

a08fa77833ace89dbc789d804f9f5632fec0b64a301567e07f495e98c33bee42
SHA512

d347c0169a0edb846ac11b49b28b709327917e3e35d36ccc356b9377ee72982926485e1895797ac599a347782fcdcc1e1511352461138bc2a617c9da437ccef3

Score

10^/10

Family

zloader

Botnet

googleaktualizacija

Campaign

googleaktualizacija2

https://iqowijsdakm.com/gate.php

https://wiewjdmkfjn.com/gate.php

https://dksaoidiakjd.com/gate.php

https://iweuiqjdakjd.com/gate.php

https://yuidskadjna.com/gate.php

https://olksmadnbdj.com/gate.php

https://odsakmdfnbs.com/gate.php

https://odsakjmdnhsaj.com/gate.php

https://odjdnhsaj.com/gate.php

https://odoishsaj.com/gate.php

Attributes

rc4.plain

rsa_pubkey.plain

Zloader, Terdot, DELoader, ZeusSphinx
Zloader is a malware strain that was initially discovered back in August 2015.
trojan botnet zloader

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 1992 wrote to memory of 1268	1992	rundll32.exe	rundll32.exe
PID 1992 wrote to memory of 1268	1992	rundll32.exe	rundll32.exe
PID 1992 wrote to memory of 1268	1992	rundll32.exe	rundll32.exe
PID 1992 wrote to memory of 1268	1992	rundll32.exe	rundll32.exe
PID 1992 wrote to memory of 1268	1992	rundll32.exe	rundll32.exe
PID 1992 wrote to memory of 1268	1992	rundll32.exe	rundll32.exe
PID 1992 wrote to memory of 1268	1992	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\a08fa77833ace89dbc789d804f9f5632fec0b64a301567e07f495e98c33bee42.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1992
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\a08fa77833ace89dbc789d804f9f5632fec0b64a301567e07f495e98c33bee42.dll,#1
  2⤵
  PID:1268
- - C:\Windows\SysWOW64\msiexec.exe
    msiexec.exe
    3⤵
    PID:1680

memory/1268-54-0x00000000765D1000-0x00000000765D3000-memory.dmp

Filesize
8KB

Download
memory/1268-55-0x0000000000260000-0x0000000000282000-memory.dmp

Filesize
136KB

Download
memory/1268-56-0x0000000010000000-0x000000001006E000-memory.dmp

Filesize
440KB

Download
memory/1680-57-0x0000000000090000-0x00000000000B6000-memory.dmp

Filesize
152KB

Download
memory/1680-59-0x00000000000C0000-0x00000000000C1000-memory.dmp

Filesize
4KB

Download
memory/1680-61-0x0000000000090000-0x00000000000B6000-memory.dmp

Filesize
152KB

Download
memory/1680-63-0x0000000000090000-0x00000000000B6000-memory.dmp

Filesize
152KB

Download