General

  • Target

    8176f21fb83482ae1e7a723fdc352697795f07d03c30ff68410203127369c974

  • Size

    1.0MB

  • Sample

    220524-2t3vgsagg9

  • MD5

    ea1c4f1656731c8e075fcc06557e71d1

  • SHA1

    81fc93fa20955013e7fcacdde22a9f204dc50459

  • SHA256

    8176f21fb83482ae1e7a723fdc352697795f07d03c30ff68410203127369c974

  • SHA512

    510f37a08724dbc701b1975cc497e503672d19fd4a73ad7668a5d83f001f13219cdc86d3f72bf8714f42ede6da753f5eea175455e732d382ae5ca4f565594d3a

Malware Config

Extracted

Family

zloader

Botnet

new

Campaign

new

C2

https://sfturedfyr.xyz/int.php

Attributes
  • build_id

    42

rc4.plain
rsa_pubkey.plain

Targets

    • Target

      8176f21fb83482ae1e7a723fdc352697795f07d03c30ff68410203127369c974

    • Size

      1.0MB

    • MD5

      ea1c4f1656731c8e075fcc06557e71d1

    • SHA1

      81fc93fa20955013e7fcacdde22a9f204dc50459

    • SHA256

      8176f21fb83482ae1e7a723fdc352697795f07d03c30ff68410203127369c974

    • SHA512

      510f37a08724dbc701b1975cc497e503672d19fd4a73ad7668a5d83f001f13219cdc86d3f72bf8714f42ede6da753f5eea175455e732d382ae5ca4f565594d3a

    • Zloader, Terdot, DELoader, ZeusSphinx

      Zloader is a malware strain that was initially discovered back in August 2015.

    • Adds Run key to start application

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v6

Tasks