Overview

overview

10

Static

static

cad0968f5a...b9.exe

windows7-x64

10

cad0968f5a...b9.exe

windows10-2004-x64

10

Resubmissions

26-12-2022 13:28

221226-qqr32agb8w 10

27-10-2022 06:35

221027-hcmx6abcgr 10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    cad0968f5ab3bedeffef68bbe18f92946fb97967cef59970157029480ed15bb9

  • Size

    139KB

  • Sample

    221027-hcmx6abcgr

  • MD5

    d91b498e5fc6c91e1e86b339407b58f7

  • SHA1

    369e3c4646a69b99a797e0e288fd3145e2a6f35a

  • SHA256

    cad0968f5ab3bedeffef68bbe18f92946fb97967cef59970157029480ed15bb9

  • SHA512

    b981f7c4857327708233bf7e44bfb485c1cc7148ca850a63b12f854215edb583f5a499109d67b94f213226d23d0f4e0e5d04b888193fa5e799e30f051e9c9dbd

  • SSDEEP

    3072:XBkH2At/3YyzX2OpphkGYI+C9AwcOZBJ7zk:n6/IAFkCDc+BJ7w

Score
10/10
zloadervlenie10obnova10botnetpersistencetrojan

Malware Config

Extracted

Family

zloader

Botnet

vlenie10

Campaign

obnova10

C2

https://kdsidsiadsakfsas.com/gate.php

https://jdafiasfjsafahhfs.com/gate.php

https://dasifosafjasfhasf.com/gate.php

https://kasfajfsafhasfhaf.com/gate.php

https://fdsjfjdsfjdsjfdjsfh.com/gate.php

https://fdsjfjdsfjdsdsjajjs.com/gate.php

https://idisaudhasdhasdj.com/gate.php

https://dsjdjsjdsadhasdas.com/gate.php

https://dsdjfhdsufudhjas.com/gate.php
Attributes
  • build_id

    1869505135

rc4.plain

Targets

    • Target

      cad0968f5ab3bedeffef68bbe18f92946fb97967cef59970157029480ed15bb9

    • Size

      139KB

    • MD5

      d91b498e5fc6c91e1e86b339407b58f7

    • SHA1

      369e3c4646a69b99a797e0e288fd3145e2a6f35a

    • SHA256

      cad0968f5ab3bedeffef68bbe18f92946fb97967cef59970157029480ed15bb9

    • SHA512

      b981f7c4857327708233bf7e44bfb485c1cc7148ca850a63b12f854215edb583f5a499109d67b94f213226d23d0f4e0e5d04b888193fa5e799e30f051e9c9dbd

    • SSDEEP

      3072:XBkH2At/3YyzX2OpphkGYI+C9AwcOZBJ7zk:n6/IAFkCDc+BJ7w

    Score
    10/10
    zloadervlenie10obnova10botnetpersistencetrojan

    • Zloader, Terdot, DELoader, ZeusSphinx

      Zloader is a malware strain that was initially discovered back in August 2015.

      trojanbotnetzloader

    • Blocklisted process makes network request

    • Adds Run key to start application

      persistence

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1
T1060

Privilege Escalation

Defense Evasion

Modify Registry

1
T1112

Credential Access

Discovery

Query Registry

1
T1012

System Information Discovery

1
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks