Overview

overview

10

Static

static

1907a0cc44...78.exe

windows7_x64

10

1907a0cc44...78.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    1907a0cc44810a9ddcdcd3701c390d036feedbc55a812e797add53a7c935e178

  • Size

    2.0MB

  • Sample

    220418-fvx5qseca3

  • MD5

    b5843ad453d4b6e360b939c5d348d0b2

  • SHA1

    511b7849dfbca06c951001f8f3e958806fd4acfa

  • SHA256

    1907a0cc44810a9ddcdcd3701c390d036feedbc55a812e797add53a7c935e178

  • SHA512

    0eeeb1f0e88fb66f0d44e836ae8e9d7eebcb039397abe4ce331071d8077a7e84e4286e432c80a39502cd46548a1ce973eff195de2325d298ecb1980bcbf77ef2

Score
10/10
zloadereldoeldobotnettrojan

Malware Config

Extracted

Family

zloader

Botnet

ELDO

Campaign

ELDO

C2

https://notsweets.net/LKhwojehDgwegSDG/gateJKjdsh.php

https://olpons.com/LKhwojehDgwegSDG/gateJKjdsh.php

https://karamelliar.org/LKhwojehDgwegSDG/gateJKjdsh.php

https://dogrunn.com/LKhwojehDgwegSDG/gateJKjdsh.php

https://azoraz.net/LKhwojehDgwegSDG/gateJKjdsh.php
Attributes
  • build_id

    132

rc4.plain
rsa_pubkey.plain

Targets

    • Target

      1907a0cc44810a9ddcdcd3701c390d036feedbc55a812e797add53a7c935e178

    • Size

      2.0MB

    • MD5

      b5843ad453d4b6e360b939c5d348d0b2

    • SHA1

      511b7849dfbca06c951001f8f3e958806fd4acfa

    • SHA256

      1907a0cc44810a9ddcdcd3701c390d036feedbc55a812e797add53a7c935e178

    • SHA512

      0eeeb1f0e88fb66f0d44e836ae8e9d7eebcb039397abe4ce331071d8077a7e84e4286e432c80a39502cd46548a1ce973eff195de2325d298ecb1980bcbf77ef2

    Score
    10/10
    zloadereldoeldobotnettrojan

    • Suspicious use of NtCreateUserProcessOtherParentProcess

    • Zloader, Terdot, DELoader, ZeusSphinx

      Zloader is a malware strain that was initially discovered back in August 2015.

      trojanbotnetzloader

    • Blocklisted process makes network request

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks