Overview

overview

10

Static

static

1

d7ea78ed27...65.exe

windows7_x64

10

d7ea78ed27...65.exe

windows10-2004_x64

7

Sharing

Copy URL Twitter E-mail

General

  • Target
    d7ea78ed27fd9b409d82b101317e7fc3f513efe456de24d62c13d443033e3165
  • Size 199KB
  • Sample220512-cqtpzaagfk
  • SHA256 d7ea78ed27fd9b409d82b101317e7fc3f513efe456de24d62c13d443033e3165
  • MD5 SHA1 SHA512
Score
10/10
zloadersgsgbotnettrojan

Malware Config

Extracted

Family

  • zloader

Botnet

  • SG

Campaign

  • SG

C2

  • https://imagn.at/LKhwojehDgwegSDG/gateJKjdsh.php

  • https://freebreez.com/LKhwojehDgwegSDG/gateJKjdsh.php

  • https://makaronz.com/LKhwojehDgwegSDG/gateJKjdsh.php

  • https://ricklick.com/LKhwojehDgwegSDG/gateJKjdsh.php

  • https://litlblockblack.com/LKhwojehDgwegSDG/gateJKjdsh.php

  • https://vaktorianpackif.com/LKhwojehDgwegSDG/gateJKjdsh.php

  • https://hbamefphmqsdgkqojgwe.com/LKhwojehDgwegSDG/gateJKjdsh.php

  • https://wuktmlbilrsbvsbkdetb.com/LKhwojehDgwegSDG/gateJKjdsh.php

  • https://yrsfuaegsevyffrfsgpj.com/LKhwojehDgwegSDG/gateJKjdsh.php

Attributes
  • build_id

    107

rc4.plain
rsa_pubkey.plain

Targets

    • Target
      d7ea78ed27fd9b409d82b101317e7fc3f513efe456de24d62c13d443033e3165
    • Size 199KB
    • SHA256 d7ea78ed27fd9b409d82b101317e7fc3f513efe456de24d62c13d443033e3165
    • MD5 SHA1 SHA512
    Score
    10/10
    zloadersgsgbotnettrojan

    • Zloader, Terdot, DELoader, ZeusSphinx

      Zloader is a malware strain that was initially discovered back in August 2015.

      trojanbotnetzloader

    • Loads dropped DLL

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks