zloader | 165c11e7e28827baa961ca56a8257310c482b20db7505d802ca3f4a52a281ee3 | Triage

Resubmissions

15-11-2023 13:36

231115-qv8lkscc9t 10

10-08-2023 16:27

230810-tyaeqsgg3v 10

26-03-2022 21:48

220326-1n5w8aebck 10

Sharing

General

Target

165c11e7e28827baa961ca56a8257310c482b20db7505d802ca3f4a52a281ee3
Size

3.0MB
Sample

220326-1n5w8aebck
MD5

95923b1905fedaebd85cbd80baa159e8
SHA1

720681368a92571f966e25025bb75938caeb8f63
SHA256

165c11e7e28827baa961ca56a8257310c482b20db7505d802ca3f4a52a281ee3
SHA512

64c5eebe4c1688a84d36dec96baee720317348bdf65196386e22a7cab644122ff940cf558a178134d1abaef97ba43713057ce7cca1840d9e8a582dfc439312fc

Score

10^/10

zloader goldhub 24.02_spamer botnet persistence trojan

Malware Config

Extracted

Family

zloader

Botnet

goldhub

Campaign

24.02_spamer

C2

https://baj3tu.xyz/thread.php

Attributes

build_id
20

rc4.plain

Targets

- Target
  
  165c11e7e28827baa961ca56a8257310c482b20db7505d802ca3f4a52a281ee3
- Size
  
  3.0MB
- MD5
  
  95923b1905fedaebd85cbd80baa159e8
- SHA1
  
  720681368a92571f966e25025bb75938caeb8f63
- SHA256
  
  165c11e7e28827baa961ca56a8257310c482b20db7505d802ca3f4a52a281ee3
- SHA512
  
  64c5eebe4c1688a84d36dec96baee720317348bdf65196386e22a7cab644122ff940cf558a178134d1abaef97ba43713057ce7cca1840d9e8a582dfc439312fc
Score

10^/10

zloader goldhub 24.02_spamer botnet persistence trojan
- Zloader, Terdot, DELoader, ZeusSphinx
  Zloader is a malware strain that was initially discovered back in August 2015.
  trojan botnet zloader
- Adds Run key to start application
  persistence
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

Privilege Escalation

Defense Evasion

Modify Registry

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks

static1

behavioral1

zloadergoldhub24.02_spamerbotnetpersistencetrojan

behavioral2

zloadergoldhub24.02_spamerbotnetpersistencetrojan