zloader | 787c78e5654a6671a8e7f499d5d45a6c04f33a1a0d4b2226752b70da52ea592b

Analysis

Target

787c78e5654a6671a8e7f499d5d45a6c04f33a1a0d4b2226752b70da52ea592b.exe
Size

736KB
MD5

5c26254bbde4b83aa81994a0386daf2a
SHA1

4d6a63deaaf17cc6753419dffb33f402714cf83d
SHA256

787c78e5654a6671a8e7f499d5d45a6c04f33a1a0d4b2226752b70da52ea592b
SHA512

865df8fc49ad434ebfa55620944f333a00401905b169b38b21c58ca15af67888f8616241ed37950bd1b217720f33a3fa1ceb9d6b6b0f2c5ed44bfed9223b07e7

Score

10^/10

Family

zloader

Botnet

google1

Campaign

google1

https://eecakesconf.at/web982/gate.php

Attributes

rc4.plain

rsa_pubkey.plain

Zloader, Terdot, DELoader, ZeusSphinx
Zloader is a malware strain that was initially discovered back in August 2015.
trojan botnet zloader

Suspicious use of SetThreadContext 1 IoCs

Processes:

787c78e5654a6671a8e7f499d5d45a6c04f33a1a0d4b2226752b70da52ea592b.exe

description	pid	process	target process
PID 1888 set thread context of 4200	1888	787c78e5654a6671a8e7f499d5d45a6c04f33a1a0d4b2226752b70da52ea592b.exe	msiexec.exe

Suspicious use of WriteProcessMemory 5 IoCs

Processes:

787c78e5654a6671a8e7f499d5d45a6c04f33a1a0d4b2226752b70da52ea592b.exe

description	pid	process	target process
PID 1888 wrote to memory of 4200	1888	787c78e5654a6671a8e7f499d5d45a6c04f33a1a0d4b2226752b70da52ea592b.exe	msiexec.exe
PID 1888 wrote to memory of 4200	1888	787c78e5654a6671a8e7f499d5d45a6c04f33a1a0d4b2226752b70da52ea592b.exe	msiexec.exe
PID 1888 wrote to memory of 4200	1888	787c78e5654a6671a8e7f499d5d45a6c04f33a1a0d4b2226752b70da52ea592b.exe	msiexec.exe
PID 1888 wrote to memory of 4200	1888	787c78e5654a6671a8e7f499d5d45a6c04f33a1a0d4b2226752b70da52ea592b.exe	msiexec.exe
PID 1888 wrote to memory of 4200	1888	787c78e5654a6671a8e7f499d5d45a6c04f33a1a0d4b2226752b70da52ea592b.exe	msiexec.exe

memory/1888-130-0x0000000000B00000-0x0000000000B29000-memory.dmp

Filesize
164KB

Download
memory/1888-131-0x0000000000B00000-0x0000000000EA8000-memory.dmp

Filesize
3.7MB

Download
memory/1888-132-0x0000000000B00000-0x0000000000EA8000-memory.dmp

Filesize
3.7MB

Download
memory/4200-133-0x0000000000000000-mapping.dmp

Download
memory/4200-134-0x0000000000380000-0x00000000003A9000-memory.dmp

Filesize
164KB

Download
memory/4200-135-0x0000000000380000-0x00000000003A9000-memory.dmp

Filesize
164KB

Download