zloader | 787c78e5654a6671a8e7f499d5d45a6c04f33a1a0d4b2226752b70da52ea592b | Triage

Analysis

max time kernel
87s
max time network
41s
platform
windows7_x64
resource
win7-20220414-en
submitted
18-04-2022 05:12

Sharing

Report Analysis Logs

General

Target

787c78e5654a6671a8e7f499d5d45a6c04f33a1a0d4b2226752b70da52ea592b.exe
Size

736KB
MD5

5c26254bbde4b83aa81994a0386daf2a
SHA1

4d6a63deaaf17cc6753419dffb33f402714cf83d
SHA256

787c78e5654a6671a8e7f499d5d45a6c04f33a1a0d4b2226752b70da52ea592b
SHA512

865df8fc49ad434ebfa55620944f333a00401905b169b38b21c58ca15af67888f8616241ed37950bd1b217720f33a3fa1ceb9d6b6b0f2c5ed44bfed9223b07e7

Score

10^/10

zloader google1 google1 botnet trojan

Malware Config

Extracted

Family

zloader

Botnet

google1

Campaign

google1

C2

https://eecakesconf.at/web982/gate.php

Attributes

build_id
2

rc4.plain

rsa_pubkey.plain

Signatures

Zloader, Terdot, DELoader, ZeusSphinx
Zloader is a malware strain that was initially discovered back in August 2015.
trojan botnet zloader

C:\Users\Admin\AppData\Local\Temp\787c78e5654a6671a8e7f499d5d45a6c04f33a1a0d4b2226752b70da52ea592b.exe
"C:\Users\Admin\AppData\Local\Temp\787c78e5654a6671a8e7f499d5d45a6c04f33a1a0d4b2226752b70da52ea592b.exe"
1⤵
PID:2032

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2032-54-0x0000000075221000-0x0000000075223000-memory.dmp

Filesize
8KB

Download
memory/2032-56-0x0000000000FD0000-0x0000000001378000-memory.dmp

Filesize
3.7MB

Download
memory/2032-55-0x0000000000FD0000-0x0000000000FF9000-memory.dmp

Filesize
164KB

Download
memory/2032-57-0x0000000000FD0000-0x0000000001378000-memory.dmp

Filesize
3.7MB

Download