zloader | f71190dc8f61cd12973cdcd12907b1bc4badde565923dc2e10b66b387977390a

Analysis

Target

f71190dc8f61cd12973cdcd12907b1bc4badde565923dc2e10b66b387977390a.dll
Size

387KB
MD5

6be160e07c67e20f34890c68e947f2be
SHA1

d283d4eeb4f4c2e1221999b41ed4d1f166fcca45
SHA256

f71190dc8f61cd12973cdcd12907b1bc4badde565923dc2e10b66b387977390a
SHA512

99b64158d7d379384e5566fccb59d1bad1df30a0364fe2bc94b069c0acda4ef762c9795c41f3a06a1d3c38c4ea38269105821b31a4e2bdd89d5f6303d60182df

Score

10^/10

Family

zloader

Botnet

nut

Campaign

17/11

https://www.jaspalandassociates.com/logs.php

https://physiotherapywala.com/logs.php

https://proactivefacilities.com/logs.php

https://www.kabiraprints.in/logs.php

https://www.joinaslicagent.co.in/logs.php

https://mintcennelattti.ga/wp-smarts.php

Attributes

rc4.plain

rsa_pubkey.plain

Zloader, Terdot, DELoader, ZeusSphinx
Zloader is a malware strain that was initially discovered back in August 2015.
trojan botnet zloader

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 1876 wrote to memory of 1816	1876	rundll32.exe	rundll32.exe
PID 1876 wrote to memory of 1816	1876	rundll32.exe	rundll32.exe
PID 1876 wrote to memory of 1816	1876	rundll32.exe	rundll32.exe
PID 1876 wrote to memory of 1816	1876	rundll32.exe	rundll32.exe
PID 1876 wrote to memory of 1816	1876	rundll32.exe	rundll32.exe
PID 1876 wrote to memory of 1816	1876	rundll32.exe	rundll32.exe
PID 1876 wrote to memory of 1816	1876	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\f71190dc8f61cd12973cdcd12907b1bc4badde565923dc2e10b66b387977390a.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1876
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\f71190dc8f61cd12973cdcd12907b1bc4badde565923dc2e10b66b387977390a.dll,#1
  2⤵
  PID:1816

memory/1116-59-0x0000000000090000-0x00000000000B6000-memory.dmp

Filesize
152KB

Download
memory/1116-61-0x00000000000C0000-0x00000000000C1000-memory.dmp

Filesize
4KB

Download
memory/1116-62-0x0000000000090000-0x00000000000B6000-memory.dmp

Filesize
152KB

Download
memory/1116-63-0x0000000000000000-mapping.dmp

Download
memory/1116-65-0x0000000000090000-0x00000000000B6000-memory.dmp

Filesize
152KB

Download
memory/1816-54-0x0000000000000000-mapping.dmp

Download
memory/1816-55-0x0000000075EB1000-0x0000000075EB3000-memory.dmp

Filesize
8KB

Download
memory/1816-57-0x0000000074C40000-0x0000000074CB1000-memory.dmp

Filesize
452KB

Download
memory/1816-56-0x0000000074C40000-0x0000000074C66000-memory.dmp

Filesize
152KB

Download
memory/1816-58-0x0000000074C40000-0x0000000074CB1000-memory.dmp

Filesize
452KB

Download