Overview

overview

10

Static

static

830700df4f...46.dll

windows7-x64

10

830700df4f...46.dll

windows10-1703-x64

10

830700df4f...46.dll

windows10-2004-x64

10

Resubmissions

26-12-2022 13:27

221226-qp417sda45 10

30-11-2022 14:19

221130-rm688abe4x 10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    830700df4fc2b75b067479d6f2f67d51dff7e883d2a33793c905380a9351cb46

  • Size

    493KB

  • Sample

    221226-qp417sda45

  • MD5

    efddc2807ecbdffd694cd97936404053

  • SHA1

    c68b7b94e591fbc4cda9bdb8c2caaa33880464c7

  • SHA256

    830700df4fc2b75b067479d6f2f67d51dff7e883d2a33793c905380a9351cb46

  • SHA512

    e6b0fd0f52c5b7e82bb66d08c4a3f8a4bddf1ce75c140e73afb4c1f57131df81e5d39f7833de15b40e980f0605bfd1840f81b610134634db000f6e18388bf09a

  • SSDEEP

    12288:WsCr6MfAEtHaqxnXmtkl0CMh+1wY7JuegO4I9y:Wsi6MBtHBzlRMg1wY34I9y

Score
10/10
zloadernut18/02botnettrojan

Malware Config

Extracted

Family

zloader

Botnet

nut

Campaign

18/02

C2

https://ramkanshop.ir/post.php

https://lph786.com/post.php

https://efaschoolfarooka.com/post.php

https://forexstick.com/post.php

https://firteccom.com/post.php

https://www.psychologynewmind.com/post.php

https://dirashightapbide.tk/post.php
Attributes
  • build_id

    358

rc4.plain
rsa_pubkey.plain

Targets

    • Target

      830700df4fc2b75b067479d6f2f67d51dff7e883d2a33793c905380a9351cb46

    • Size

      493KB

    • MD5

      efddc2807ecbdffd694cd97936404053

    • SHA1

      c68b7b94e591fbc4cda9bdb8c2caaa33880464c7

    • SHA256

      830700df4fc2b75b067479d6f2f67d51dff7e883d2a33793c905380a9351cb46

    • SHA512

      e6b0fd0f52c5b7e82bb66d08c4a3f8a4bddf1ce75c140e73afb4c1f57131df81e5d39f7833de15b40e980f0605bfd1840f81b610134634db000f6e18388bf09a

    • SSDEEP

      12288:WsCr6MfAEtHaqxnXmtkl0CMh+1wY7JuegO4I9y:Wsi6MBtHBzlRMg1wY34I9y

    Score
    10/10
    zloadernut18/02botnettrojan

    • Zloader, Terdot, DELoader, ZeusSphinx

      Zloader is a malware strain that was initially discovered back in August 2015.

      trojanbotnetzloader

    • Blocklisted process makes network request

    • Suspicious use of SetThreadContext

    behavioral1behavioral2behavioral3

MITRE ATT&CK Matrix

Tasks