Description
Zloader is a malware strain that was initially discovered back in August 2015.
dbeba2fb33aaba42768a5ed8055cc8ca4009ad1921319f90c78b78d4f0dd9f7b
General
Target
Size
Sample
dbeba2fb33aaba42768a5ed8055cc8ca4009ad1921319f90c78b78d4f0dd9f7b
489KB
220520-3l56bacaer
Score
10 /10
MD5
SHA1
SHA256
SHA512
8c293fe05b3af514723a1639810c06a3
ac2f7668c7f3049930b52a83585ac479145cd059
dbeba2fb33aaba42768a5ed8055cc8ca4009ad1921319f90c78b78d4f0dd9f7b
2f8db26e93c54b08944a4080e55595f348090086f849fe427f6f07b17a8a57926b1e0d6481356feb0846af0c01ffbb06122750974d3f80e2ea3c465aab1acc23
Malware Config
Extracted
| Family | zloader |
| Botnet | bot5 |
| Campaign | bot5 |
| C2 |
https://militanttra.at/owg.php |
| Attributes |
build_id 15 |
| rc4.plain |
|
| rsa_pubkey.plain |
|
Targets
Target
MD5
Filesize
dbeba2fb33aaba42768a5ed8055cc8ca4009ad1921319f90c78b78d4f0dd9f7b
8c293fe05b3af514723a1639810c06a3
489KB
Score
10/10
SHA1
SHA256
SHA512
ac2f7668c7f3049930b52a83585ac479145cd059
dbeba2fb33aaba42768a5ed8055cc8ca4009ad1921319f90c78b78d4f0dd9f7b
2f8db26e93c54b08944a4080e55595f348090086f849fe427f6f07b17a8a57926b1e0d6481356feb0846af0c01ffbb06122750974d3f80e2ea3c465aab1acc23
Tags
Signatures
-
Zloader, Terdot, DELoader, ZeusSphinx
-
Adds Run key to start application
Tags
TTPs
-
Suspicious use of SetThreadContext
Related Tasks
MITRE ATT&CK Matrix
Collection
Command and Control
Credential Access
Defense Evasion
Discovery
Execution
Exfiltration
Impact
Initial Access
Lateral Movement
Persistence
Privilege Escalation
Tasks