zloader | 6f3d6311fb91f7dea3d8d83833c94ee81b4e936d181619c5c9166f6994532141 | Triage

Sharing

General

Target

6f3d6311fb91f7dea3d8d83833c94ee81b4e936d181619c5c9166f6994532141
Size

282KB
Sample

220418-l9kqvabahr
MD5

24a14eb9657fff6c151b279556cba1f0
SHA1

843624d36b63100beb5bc05e4ddec5659317eb9d
SHA256

6f3d6311fb91f7dea3d8d83833c94ee81b4e936d181619c5c9166f6994532141
SHA512

30043da4f8aa33085f2d8238d7151c06f74c8376a3bc2f9deba492e2692d3ed79b7737f416eed11fed9f40d273f84917717b7ecfa745b4fb30274c689664f024

Score

10^/10

zloader r2 r2 botnet suricata trojan

Malware Config

Extracted

Family

zloader

Botnet

r2

Campaign

r2

C2

https://notsweets.net/LKhwojehDgwegSDG/gateJKjdsh.php

https://olpons.com/LKhwojehDgwegSDG/gateJKjdsh.php

https://karamelliar.org/LKhwojehDgwegSDG/gateJKjdsh.php

https://dogrunn.com/LKhwojehDgwegSDG/gateJKjdsh.php

https://azoraz.net/LKhwojehDgwegSDG/gateJKjdsh.php

Attributes

build_id
136

rc4.plain

rsa_pubkey.plain

Targets

- Target
  
  6f3d6311fb91f7dea3d8d83833c94ee81b4e936d181619c5c9166f6994532141
- Size
  
  282KB
- MD5
  
  24a14eb9657fff6c151b279556cba1f0
- SHA1
  
  843624d36b63100beb5bc05e4ddec5659317eb9d
- SHA256
  
  6f3d6311fb91f7dea3d8d83833c94ee81b4e936d181619c5c9166f6994532141
- SHA512
  
  30043da4f8aa33085f2d8238d7151c06f74c8376a3bc2f9deba492e2692d3ed79b7737f416eed11fed9f40d273f84917717b7ecfa745b4fb30274c689664f024
Score

10^/10

zloader r2 r2 botnet trojan suricata
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Zloader, Terdot, DELoader, ZeusSphinx
  Zloader is a malware strain that was initially discovered back in August 2015.
  trojan botnet zloader
- suricata: ET MALWARE Zbot POST Request to C2
  suricata: ET MALWARE Zbot POST Request to C2
  suricata
- Blocklisted process makes network request
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Matrix

Tasks

static1

behavioral1

zloaderr2r2botnettrojan

behavioral2

zloaderr2r2botnetsuricatatrojan