zloader | 1907a0cc44810a9ddcdcd3701c390d036feedbc55a812e797add53a7c935e178

Analysis

max time kernel
82s
max time network
153s
platform
windows7_x64
resource
win7-20220414-en
submitted
18-04-2022 05:12

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

1907a0cc44810a9ddcdcd3701c390d036feedbc55a812e797add53a7c935e178.exe
Size

2.0MB
MD5

b5843ad453d4b6e360b939c5d348d0b2
SHA1

511b7849dfbca06c951001f8f3e958806fd4acfa
SHA256

1907a0cc44810a9ddcdcd3701c390d036feedbc55a812e797add53a7c935e178
SHA512

0eeeb1f0e88fb66f0d44e836ae8e9d7eebcb039397abe4ce331071d8077a7e84e4286e432c80a39502cd46548a1ce973eff195de2325d298ecb1980bcbf77ef2

Score

10^/10

zloader eldo eldo botnet trojan

Malware Config

Extracted

Family

zloader

Botnet

ELDO

Campaign

ELDO

https://notsweets.net/LKhwojehDgwegSDG/gateJKjdsh.php

https://olpons.com/LKhwojehDgwegSDG/gateJKjdsh.php

https://karamelliar.org/LKhwojehDgwegSDG/gateJKjdsh.php

https://dogrunn.com/LKhwojehDgwegSDG/gateJKjdsh.php

https://azoraz.net/LKhwojehDgwegSDG/gateJKjdsh.php

Attributes

build_id
132

rc4.plain

rsa_pubkey.plain

Signatures

Zloader, Terdot, DELoader, ZeusSphinx
Zloader is a malware strain that was initially discovered back in August 2015.
trojan botnet zloader

C:\Users\Admin\AppData\Local\Temp\1907a0cc44810a9ddcdcd3701c390d036feedbc55a812e797add53a7c935e178.exe
"C:\Users\Admin\AppData\Local\Temp\1907a0cc44810a9ddcdcd3701c390d036feedbc55a812e797add53a7c935e178.exe"
1⤵
PID:1440

C:\Windows\SysWOW64\msiexec.exe
msiexec.exe
1⤵
PID:1516

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1440-54-0x0000000075711000-0x0000000075713000-memory.dmp

Filesize
8KB

Download
memory/1440-55-0x0000000000B40000-0x0000000000B66000-memory.dmp

Filesize
152KB

Download
memory/1440-56-0x0000000000B40000-0x0000000000E39000-memory.dmp

Filesize
3.0MB

Download
memory/1440-57-0x0000000000B40000-0x0000000000E39000-memory.dmp

Filesize
3.0MB

Download
memory/1516-58-0x0000000000090000-0x00000000000B6000-memory.dmp

Filesize
152KB

Download
memory/1516-60-0x00000000000C0000-0x00000000000C1000-memory.dmp

Filesize
4KB

Download
memory/1516-61-0x0000000000090000-0x00000000000B6000-memory.dmp

Filesize
152KB

Download
memory/1516-62-0x0000000000000000-mapping.dmp

Download
memory/1516-64-0x0000000000090000-0x00000000000B6000-memory.dmp

Filesize
152KB

Download