Resubmissions

17-11-2023 12:52

231117-p4a61ahe33 10

25-05-2022 01:43

220525-b4865safbq 10

General

  • Target

    416d2c5e0f1306321ff4aa05aebd175e55aea6579f8062777a5feb2bb5ea6c95

  • Size

    1.0MB

  • Sample

    220525-b4865safbq

  • MD5

    db0c5cbd776f17c7c06df6cabd908282

  • SHA1

    44da893813ce219c616aefb6cf29e71e27e6f419

  • SHA256

    416d2c5e0f1306321ff4aa05aebd175e55aea6579f8062777a5feb2bb5ea6c95

  • SHA512

    2cfa156bb4820db963c6219483948a72c51c4849215198df8d1fb474d6e4943340bef46fc3ebcd4befbd7596913742c2f197f640b4508c9f1982cf69cbaf2079

Malware Config

Extracted

Family

zloader

Botnet

new

Campaign

new

C2

https://sfturedfyr.xyz/int.php

Attributes
  • build_id

    42

rc4.plain
rsa_pubkey.plain

Targets

    • Target

      416d2c5e0f1306321ff4aa05aebd175e55aea6579f8062777a5feb2bb5ea6c95

    • Size

      1.0MB

    • MD5

      db0c5cbd776f17c7c06df6cabd908282

    • SHA1

      44da893813ce219c616aefb6cf29e71e27e6f419

    • SHA256

      416d2c5e0f1306321ff4aa05aebd175e55aea6579f8062777a5feb2bb5ea6c95

    • SHA512

      2cfa156bb4820db963c6219483948a72c51c4849215198df8d1fb474d6e4943340bef46fc3ebcd4befbd7596913742c2f197f640b4508c9f1982cf69cbaf2079

    • Zloader, Terdot, DELoader, ZeusSphinx

      Zloader is a malware strain that was initially discovered back in August 2015.

    • Adds Run key to start application

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v6

Tasks