General
-
Target
4b6ee2fde3060c828d452cd2fc5f18979ed5dfc612c204867d35e8e613dedfda
-
Size
210KB
-
Sample
220502-j9rhaabfgk
-
MD5
4bfa9cefa15eac5ca5cded94aa2c5e1b
-
SHA1
1a853121291b92f5e9aeb223207a2fb7a50c4c9c
-
SHA256
4b6ee2fde3060c828d452cd2fc5f18979ed5dfc612c204867d35e8e613dedfda
-
SHA512
c3aeaec789c9eeb9f097316b3b1baa795ae62db81c43402c77617f344a855bdb09c8bc6726d7b0912da38147d67e2c39ad3dbbb8625660129daf708ac5f621f9
Malware Config
Extracted
zloader
r1
r1
https://freebreez.com/LKhwojehDgwegSDG/gateJKjdsh.php
https://makaronz.com/LKhwojehDgwegSDG/gateJKjdsh.php
https://ricklick.com/LKhwojehDgwegSDG/gateJKjdsh.php
https://litlblockblack.com/LKhwojehDgwegSDG/gateJKjdsh.php
https://vaktorianpackif.com/LKhwojehDgwegSDG/gateJKjdsh.php
https://hbamefphmqsdgkqojgwe.com/LKhwojehDgwegSDG/gateJKjdsh.php
https://hoxfqvlgoabyfspvjimc.com/LKhwojehDgwegSDG/gateJKjdsh.php
https://yrsfuaegsevyffrfsgpj.com/LKhwojehDgwegSDG/gateJKjdsh.php
-
build_id
83
Targets
-
-
Target
4b6ee2fde3060c828d452cd2fc5f18979ed5dfc612c204867d35e8e613dedfda
-
Size
210KB
-
MD5
4bfa9cefa15eac5ca5cded94aa2c5e1b
-
SHA1
1a853121291b92f5e9aeb223207a2fb7a50c4c9c
-
SHA256
4b6ee2fde3060c828d452cd2fc5f18979ed5dfc612c204867d35e8e613dedfda
-
SHA512
c3aeaec789c9eeb9f097316b3b1baa795ae62db81c43402c77617f344a855bdb09c8bc6726d7b0912da38147d67e2c39ad3dbbb8625660129daf708ac5f621f9
Score10/10-
Suspicious use of NtCreateUserProcessOtherParentProcess
-
Zloader, Terdot, DELoader, ZeusSphinx
Zloader is a malware strain that was initially discovered back in August 2015.
-
Suspicious use of SetThreadContext
-