Overview

overview

10

Static

static

aed3dfe631...e1.exe

windows7_x64

10

aed3dfe631...e1.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    aed3dfe631190b233b06f472c55af6dd1d222bc07c3ac32284a29555bf6bf1e1

  • Size

    204KB

  • Sample

    220508-glnelsgfe5

  • MD5

    3c444a0943effa540416d6e44fbcb13d

  • SHA1

    e9d69e561e6adbac9e5db5375fd6b138d2fb3d2b

  • SHA256

    aed3dfe631190b233b06f472c55af6dd1d222bc07c3ac32284a29555bf6bf1e1

  • SHA512

    7496257548078d4f23229545d48f23a828c8afffca78bf6c0a3c4d78a2b83439629bff2d7b6753e78c214d1960abf1a535a61a8cfd25e10285228200b305781a

Score
10/10
zloadercanadaloadsnerinobotnetpersistencesuricatatrojan

Malware Config

Extracted

Family

zloader

Botnet

CanadaLoads

Campaign

Nerino

C2

https://tempmailsin112.com/bFnF0y1r/7QKpXmV3Pz.php

https://roadonroadonroad.com/bFnF0y1r/7QKpXmV3Pz.php

https://roadtocaliss.com/bFnF0y1r/7QKpXmV3Pz.php

https://referrer222.com/bFnF0y1r/7QKpXmV3Pz.php

https://makeitrainfordee.com/bFnF0y1r/7QKpXmV3Pz.php

https://makeitrainforffeer.com/bFnF0y1r/7QKpXmV3Pz.php

https://torosdodos221.com/bFnF0y1r/7QKpXmV3Pz.php

https://morningcoffeeclasd.com/bFnF0y1r/7QKpXmV3Pz.php

https://rememberingtss.com/bFnF0y1r/7QKpXmV3Pz.php

https://dodavova012.com/bFnF0y1r/7QKpXmV3Pz.php
Attributes
  • build_id

    67

rc4.plain
rsa_pubkey.plain

Targets

    • Target

      aed3dfe631190b233b06f472c55af6dd1d222bc07c3ac32284a29555bf6bf1e1

    • Size

      204KB

    • MD5

      3c444a0943effa540416d6e44fbcb13d

    • SHA1

      e9d69e561e6adbac9e5db5375fd6b138d2fb3d2b

    • SHA256

      aed3dfe631190b233b06f472c55af6dd1d222bc07c3ac32284a29555bf6bf1e1

    • SHA512

      7496257548078d4f23229545d48f23a828c8afffca78bf6c0a3c4d78a2b83439629bff2d7b6753e78c214d1960abf1a535a61a8cfd25e10285228200b305781a

    Score
    10/10
    zloadercanadaloadsnerinobotnetpersistencetrojansuricata

    • Zloader, Terdot, DELoader, ZeusSphinx

      Zloader is a malware strain that was initially discovered back in August 2015.

      trojanbotnetzloader

    • suricata: ET MALWARE Zbot POST Request to C2

      suricata: ET MALWARE Zbot POST Request to C2

      suricata

    • Blocklisted process makes network request

    • Adds Run key to start application

      persistence

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1
T1060

Privilege Escalation

Defense Evasion

Modify Registry

1
T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks