General

  • Target

    71cff9414b7367b65c96e8e98a2ee019f44eaa7e0d7d0f2d086a517c0d7cffb7

  • Size

    541KB

  • Sample

    220503-anlv8sfgcl

  • MD5

    a6edb6cb8f14e1a7cee7427ffafacb23

  • SHA1

    0edeb470ec8736417ad1eb02a7c2191c2e92529f

  • SHA256

    71cff9414b7367b65c96e8e98a2ee019f44eaa7e0d7d0f2d086a517c0d7cffb7

  • SHA512

    ec6e5b1c841c08f26584fc0f7baa2aa6a70098ba1d1fb06880758dbce9bc80911f94ee6b5eddbd9679ee0eeb080ad43de40ebf2d726a744a57c3f3b801828142

Malware Config

Extracted

Family

zloader

Botnet

nut

Campaign

16/10

C2

https://rkhydraulic.com/gqvvjx.php

https://sadarpursangbad.com/eraksa.php

https://t20group.com/atufik.php

https://voldemarholding.ee/b6h7s1.php

https://reach-me.co/oay1hk.php

https://acpdd.cat/sv34fs.php

https://aestheticscc.com/wbbako.php

https://procalterfineb.tk/wp-smarts.php

Attributes
  • build_id

    170

rc4.plain
rsa_pubkey.plain

Targets

    • Target

      71cff9414b7367b65c96e8e98a2ee019f44eaa7e0d7d0f2d086a517c0d7cffb7

    • Size

      541KB

    • MD5

      a6edb6cb8f14e1a7cee7427ffafacb23

    • SHA1

      0edeb470ec8736417ad1eb02a7c2191c2e92529f

    • SHA256

      71cff9414b7367b65c96e8e98a2ee019f44eaa7e0d7d0f2d086a517c0d7cffb7

    • SHA512

      ec6e5b1c841c08f26584fc0f7baa2aa6a70098ba1d1fb06880758dbce9bc80911f94ee6b5eddbd9679ee0eeb080ad43de40ebf2d726a744a57c3f3b801828142

    • Zloader, Terdot, DELoader, ZeusSphinx

      Zloader is a malware strain that was initially discovered back in August 2015.

MITRE ATT&CK Matrix

Tasks