zloader | aed3dfe631190b233b06f472c55af6dd1d222bc07c3ac32284a29555bf6bf1e1

General

Target

aed3dfe631190b233b06f472c55af6dd1d222bc07c3ac32284a29555bf6bf1e1
Size

204KB
Sample

220508-glnelsgfe5
MD5

3c444a0943effa540416d6e44fbcb13d
SHA1

e9d69e561e6adbac9e5db5375fd6b138d2fb3d2b
SHA256

aed3dfe631190b233b06f472c55af6dd1d222bc07c3ac32284a29555bf6bf1e1
SHA512

7496257548078d4f23229545d48f23a828c8afffca78bf6c0a3c4d78a2b83439629bff2d7b6753e78c214d1960abf1a535a61a8cfd25e10285228200b305781a

Score

10^/10

Malware Config

Extracted

Family

zloader

Botnet

CanadaLoads

Campaign

Nerino

C2

https://tempmailsin112.com/bFnF0y1r/7QKpXmV3Pz.php

https://roadonroadonroad.com/bFnF0y1r/7QKpXmV3Pz.php

https://roadtocaliss.com/bFnF0y1r/7QKpXmV3Pz.php

https://referrer222.com/bFnF0y1r/7QKpXmV3Pz.php

https://makeitrainfordee.com/bFnF0y1r/7QKpXmV3Pz.php

https://makeitrainforffeer.com/bFnF0y1r/7QKpXmV3Pz.php

https://torosdodos221.com/bFnF0y1r/7QKpXmV3Pz.php

https://morningcoffeeclasd.com/bFnF0y1r/7QKpXmV3Pz.php

https://rememberingtss.com/bFnF0y1r/7QKpXmV3Pz.php

https://dodavova012.com/bFnF0y1r/7QKpXmV3Pz.php

Attributes

build_id
67

rc4.plain

rsa_pubkey.plain

Targets

- Target
  
  aed3dfe631190b233b06f472c55af6dd1d222bc07c3ac32284a29555bf6bf1e1
- Size
  
  204KB
- MD5
  
  3c444a0943effa540416d6e44fbcb13d
- SHA1
  
  e9d69e561e6adbac9e5db5375fd6b138d2fb3d2b
- SHA256
  
  aed3dfe631190b233b06f472c55af6dd1d222bc07c3ac32284a29555bf6bf1e1
- SHA512
  
  7496257548078d4f23229545d48f23a828c8afffca78bf6c0a3c4d78a2b83439629bff2d7b6753e78c214d1960abf1a535a61a8cfd25e10285228200b305781a
Score

10^/10

zloader canadaloads nerino botnet persistence trojan suricata
- Zloader, Terdot, DELoader, ZeusSphinx
  Zloader is a malware strain that was initially discovered back in August 2015.
  trojan botnet zloader
- suricata: ET MALWARE Zbot POST Request to C2
  suricata: ET MALWARE Zbot POST Request to C2
  suricata
- Blocklisted process makes network request
- Adds Run key to start application
  persistence
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Targets

Zloader, Terdot, DELoader, ZeusSphinx

suricata: ET MALWARE Zbot POST Request to C2

Blocklisted process makes network request

Adds Run key to start application

Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v6

Tasks

static1

behavioral1

behavioral2