General

  • Target

    5f7096eb3e7654bc5c7230466361b3f6f5b6ae3940aa6461e530f8849ccb21b5

  • Size

    541KB

  • Sample

    220503-anmsjadcd2

  • MD5

    dcc3090f7e614a5aec91160e412139b5

  • SHA1

    e5add77436258e6fc7a29950a8386d12e428979d

  • SHA256

    5f7096eb3e7654bc5c7230466361b3f6f5b6ae3940aa6461e530f8849ccb21b5

  • SHA512

    8c221738c93c26ec81f565c7cb6a3594adcad6464dbe55060a614cfcf6f6fd528e8c410dd6ab8dbcdc6bb9d07673b7e7430da5fc83980e8b528c42709e26c6c3

Malware Config

Extracted

Family

zloader

Botnet

nut

Campaign

16/10

C2

https://rkhydraulic.com/gqvvjx.php

https://sadarpursangbad.com/eraksa.php

https://t20group.com/atufik.php

https://voldemarholding.ee/b6h7s1.php

https://reach-me.co/oay1hk.php

https://acpdd.cat/sv34fs.php

https://aestheticscc.com/wbbako.php

https://procalterfineb.tk/wp-smarts.php

Attributes
  • build_id

    170

rc4.plain
rsa_pubkey.plain

Targets

    • Target

      5f7096eb3e7654bc5c7230466361b3f6f5b6ae3940aa6461e530f8849ccb21b5

    • Size

      541KB

    • MD5

      dcc3090f7e614a5aec91160e412139b5

    • SHA1

      e5add77436258e6fc7a29950a8386d12e428979d

    • SHA256

      5f7096eb3e7654bc5c7230466361b3f6f5b6ae3940aa6461e530f8849ccb21b5

    • SHA512

      8c221738c93c26ec81f565c7cb6a3594adcad6464dbe55060a614cfcf6f6fd528e8c410dd6ab8dbcdc6bb9d07673b7e7430da5fc83980e8b528c42709e26c6c3

    • Zloader, Terdot, DELoader, ZeusSphinx

      Zloader is a malware strain that was initially discovered back in August 2015.

MITRE ATT&CK Matrix

Tasks