zloader | 3ef112a50f77507aeae019061f763ac51fcca1177759ef18f31bbb42bc633bd6

Analysis

Target

3ef112a50f77507aeae019061f763ac51fcca1177759ef18f31bbb42bc633bd6.dll
Size

269KB
MD5

93f753348d597c11766bbec6543e95a5
SHA1

128dbeb3464799d9ac4873a40c067691b9fb06e5
SHA256

3ef112a50f77507aeae019061f763ac51fcca1177759ef18f31bbb42bc633bd6
SHA512

e5df0a6513bc1b4201cd54e3d6ab12ad80724e0918ede61c9f070ae8b5b86bddd691bf053404c44deef132adc049272136233190711bf65c353b3dbbe02d06ba

Score

10^/10

Family

zloader

Botnet

kev

Campaign

15/10

https://combotraining.fr/wpdrxl.php

https://jokilink.com/4wjgxc.php

https://latinosconstruction.com/adfuon.php

https://liciousbbl.com/vuadtm.php

https://kingbhavthanbetepos.tk/wp-smarts.php

https://piksellat.com/tcsrog.php

Attributes

rc4.plain

rsa_pubkey.plain

Zloader, Terdot, DELoader, ZeusSphinx
Zloader is a malware strain that was initially discovered back in August 2015.
trojan botnet zloader

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 4904 wrote to memory of 624	4904	rundll32.exe	rundll32.exe
PID 4904 wrote to memory of 624	4904	rundll32.exe	rundll32.exe
PID 4904 wrote to memory of 624	4904	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\3ef112a50f77507aeae019061f763ac51fcca1177759ef18f31bbb42bc633bd6.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4904

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\3ef112a50f77507aeae019061f763ac51fcca1177759ef18f31bbb42bc633bd6.dll,#1
2⤵
PID:624

memory/624-130-0x0000000000000000-mapping.dmp

Download
memory/624-132-0x0000000074C90000-0x0000000074CE8000-memory.dmp

Filesize
352KB

Download
memory/624-131-0x0000000074C90000-0x0000000074CB6000-memory.dmp

Filesize
152KB

Download