Overview

overview

10

Static

static

165c11e7e2...e3.exe

windows7_x64

10

165c11e7e2...e3.exe

windows10-2004_x64

10

Resubmissions

15/11/2023, 13:36

231115-qv8lkscc9t10

10/08/2023, 16:27

230810-tyaeqsgg3v10

26/03/2022, 21:48

220326-1n5w8aebck10

Sharing

Copy URL Twitter E-mail

General

  • Target
    165c11e7e28827baa961ca56a8257310c482b20db7505d802ca3f4a52a281ee3
  • Size 3.0MB
  • Sample220326-1n5w8aebck
  • SHA256 165c11e7e28827baa961ca56a8257310c482b20db7505d802ca3f4a52a281ee3
  • MD5 SHA1 SHA512
Score
10/10
zloadergoldhub24.02_spamerbotnetpersistencetrojan

Malware Config

Extracted

Family

  • zloader

Botnet

  • goldhub

Campaign

  • 24.02_spamer

C2

  • https://baj3tu.xyz/thread.php

Attributes
  • build_id

    20

rc4.plain

Targets

    • Target
      165c11e7e28827baa961ca56a8257310c482b20db7505d802ca3f4a52a281ee3
    • Size 3.0MB
    • SHA256 165c11e7e28827baa961ca56a8257310c482b20db7505d802ca3f4a52a281ee3
    • MD5 SHA1 SHA512
    Score
    10/10
    zloadergoldhub24.02_spamerbotnetpersistencetrojan

    • Zloader, Terdot, DELoader, ZeusSphinx

      Zloader is a malware strain that was initially discovered back in August 2015.

      trojanbotnetzloader

    • Adds Run key to start application

      persistence

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks