General

  • Target

    4afd18322fa314a305c50129c89764ca9f54238c5e89d86a4a312398e8e56ca8_unpacked

  • Size

    142KB

  • Sample

    221027-hckg2abcd8

  • MD5

    1187a2f3026eed231abc21c2749e4e63

  • SHA1

    6fbe2c541fdb705f29899d7d67eb1c54decc620e

  • SHA256

    4afd18322fa314a305c50129c89764ca9f54238c5e89d86a4a312398e8e56ca8

  • SHA512

    379fdd86d12f61d59ecad4aeb26e4c6873db8b9e863ec941432a4268dde70d7c113098b5968069b22020893edb843ea7451967353375f4ba3775698b733242c2

  • SSDEEP

    3072:WxJqEQmQfL0N8tEs9IWMLsKIUmkIp+L3aOF0sEzdmldTvTMMMy:+JxQmQUs9aLsZkTeOS5di1YNy

Malware Config

Extracted

Family

zloader

Attributes
  • build_id

    929195383

Targets

    • Target

      4afd18322fa314a305c50129c89764ca9f54238c5e89d86a4a312398e8e56ca8_unpacked

    • Size

      142KB

    • MD5

      1187a2f3026eed231abc21c2749e4e63

    • SHA1

      6fbe2c541fdb705f29899d7d67eb1c54decc620e

    • SHA256

      4afd18322fa314a305c50129c89764ca9f54238c5e89d86a4a312398e8e56ca8

    • SHA512

      379fdd86d12f61d59ecad4aeb26e4c6873db8b9e863ec941432a4268dde70d7c113098b5968069b22020893edb843ea7451967353375f4ba3775698b733242c2

    • SSDEEP

      3072:WxJqEQmQfL0N8tEs9IWMLsKIUmkIp+L3aOF0sEzdmldTvTMMMy:+JxQmQUs9aLsZkTeOS5di1YNy

    • Zloader, Terdot, DELoader, ZeusSphinx

      Zloader is a malware strain that was initially discovered back in August 2015.

    • Blocklisted process makes network request

    • Adds Run key to start application

    • Suspicious use of SetThreadContext

MITRE ATT&CK Matrix ATT&CK v6

Persistence

Registry Run Keys / Startup Folder

1
T1060

Defense Evasion

Modify Registry

1
T1112

Tasks