zloader | c58d97e033d7b568ce4261959e5e04a5b1f8849ccf4f717bcac79ca728d07ace

Analysis

Target

c58d97e033d7b568ce4261959e5e04a5b1f8849ccf4f717bcac79ca728d07ace.dll
Size

445KB
MD5

62b048529ddc7e871a9807068ee5cacd
SHA1

1aef66bb26dad4ba2fd182f01efd13e44e4bfe31
SHA256

c58d97e033d7b568ce4261959e5e04a5b1f8849ccf4f717bcac79ca728d07ace
SHA512

74b64e2d78bdec8c82835c5ac7501c3a18a9ad1e25da959bfa08df77fec96ad0a6e61277c2ec4ffadf329961614d5f9f3d012351211782a9ff146fcecc9b1f04

Score

10^/10

Family

zloader

Botnet

target1

Campaign

target1

https://notsweets.net/LKhwojehDgwegSDG/gateJKjdsh.php

https://olpons.com/LKhwojehDgwegSDG/gateJKjdsh.php

https://karamelliar.org/LKhwojehDgwegSDG/gateJKjdsh.php

https://dogrunn.com/LKhwojehDgwegSDG/gateJKjdsh.php

https://azoraz.net/LKhwojehDgwegSDG/gateJKjdsh.php

Attributes

rc4.plain

rsa_pubkey.plain

Zloader, Terdot, DELoader, ZeusSphinx
Zloader is a malware strain that was initially discovered back in August 2015.
trojan botnet zloader

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 764 wrote to memory of 1688	764	rundll32.exe	rundll32.exe
PID 764 wrote to memory of 1688	764	rundll32.exe	rundll32.exe
PID 764 wrote to memory of 1688	764	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\c58d97e033d7b568ce4261959e5e04a5b1f8849ccf4f717bcac79ca728d07ace.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:764
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\c58d97e033d7b568ce4261959e5e04a5b1f8849ccf4f717bcac79ca728d07ace.dll,#1
  2⤵
  PID:1688

memory/1688-130-0x0000000000000000-mapping.dmp

Download
memory/1688-132-0x0000000074FE0000-0x0000000075060000-memory.dmp

Filesize
512KB

Download
memory/1688-131-0x0000000074FE0000-0x0000000075005000-memory.dmp

Filesize
148KB

Download
memory/1688-133-0x0000000074FE0000-0x0000000075060000-memory.dmp

Filesize
512KB

Download
memory/4452-134-0x0000000000000000-mapping.dmp

Download
memory/4452-135-0x00000000012A0000-0x00000000012C5000-memory.dmp

Filesize
148KB

Download
memory/4452-136-0x00000000012A0000-0x00000000012C5000-memory.dmp

Filesize
148KB

Download