Overview

overview

10

Static

static

b89d80ca3f...79.dll

windows7-x64

10

b89d80ca3f...79.dll

windows10-2004-x64

10

Resubmissions

26-12-2022 13:26

221226-qp1c1sgb8v 10

30-11-2022 16:32

221130-t2fe6aae9x 10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    b89d80ca3f0a5da24b8b768d2d5eb35ca1322f6bc2b01e265465ac95d7d61279

  • Size

    345KB

  • Sample

    221130-t2fe6aae9x

  • MD5

    adba2ac8f027946da258155b140c068a

  • SHA1

    91b1dceb17403910d7aa9bee1029f11153accff4

  • SHA256

    b89d80ca3f0a5da24b8b768d2d5eb35ca1322f6bc2b01e265465ac95d7d61279

  • SHA512

    356865ecaf00b10af50ec1f7ffdcc89249e1eaf2a1648c970393d7c66359e578ce9d6987f66dc49cb769e36e8ea62c4ff17d6b173bc793b61fa81e11e619229f

  • SSDEEP

    6144:q9xZILKtmfbcPK2U6gRURSxE8efnQe+R+FNHmZ04aR31cdpN0V:q9xZIL1bcPRUrURAOn8gTGCPMwV

Score
10/10
zloadernut16/02botnettrojan

Malware Config

Extracted

Family

zloader

Botnet

nut

Campaign

16/02

C2

https://wewalk.cl/post.php

https://dpack-co.com/post.php

https://dr-mirahmadi.ir/post.php

https://indiaastrologyfoundation.in/post.php

https://metisacademy.ir/post.php

https://lan-samarinda.com/post.php

https://pyouleigorgawimbwans.tk/post.php
Attributes
  • build_id

    351

rc4.plain
rsa_pubkey.plain

Targets

    • Target

      b89d80ca3f0a5da24b8b768d2d5eb35ca1322f6bc2b01e265465ac95d7d61279

    • Size

      345KB

    • MD5

      adba2ac8f027946da258155b140c068a

    • SHA1

      91b1dceb17403910d7aa9bee1029f11153accff4

    • SHA256

      b89d80ca3f0a5da24b8b768d2d5eb35ca1322f6bc2b01e265465ac95d7d61279

    • SHA512

      356865ecaf00b10af50ec1f7ffdcc89249e1eaf2a1648c970393d7c66359e578ce9d6987f66dc49cb769e36e8ea62c4ff17d6b173bc793b61fa81e11e619229f

    • SSDEEP

      6144:q9xZILKtmfbcPK2U6gRURSxE8efnQe+R+FNHmZ04aR31cdpN0V:q9xZIL1bcPRUrURAOn8gTGCPMwV

    Score
    10/10
    zloadernut16/02botnettrojan

    • Zloader, Terdot, DELoader, ZeusSphinx

      Zloader is a malware strain that was initially discovered back in August 2015.

      trojanbotnetzloader

    • Blocklisted process makes network request

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks