zloader | 461bc141026278f75214983abeafe0ce0d9be8750ee5847e858d8e56a70eefbd

General

Target

e3932ab83bc05de2e91d321c4d479ff1aa3d10fdbd91e1687c80cc0ec88270e8.zip
Size

70KB
Sample

221226-qpgkxagb8t
MD5

1647195938228c7e5aa08ba3087f0a70
SHA1

3b6149a74dad462649dba9a001c04adccdfa7d85
SHA256

461bc141026278f75214983abeafe0ce0d9be8750ee5847e858d8e56a70eefbd
SHA512

dc535439f6cb7f1c169a5c6838c9be5899c2e492d18027a6d208b3af5ac150ea6afccebeb8c8656bb36a2dc8df30953b0620946450809aa64a5996f338efdb82
SSDEEP

1536:mBtQWdV0lCRdiDgWLLDfM5iF+5ua8noKwJzjm44ZOncLeQ:0QWdV0lQDYP0cEQaqodmX0c9

Score

10^/10

Malware Config

Extracted

Family

zloader

Botnet

DLLobnova

Campaign

1017

C2

https://fdsjfjdsfjdsjfdjsfh.com/gate.php

https://fdsjfjdsfjdsdsjajjs.com/gate.php

https://idisaudhasdhasdj.com/gate.php

https://dsjdjsjdsadhasdas.com/gate.php

https://dsdjfhdsufudhjas.com/gate.php

https://dsdjfhdsufudhjas.info/gate.php

https://fdsjfjdsfjdsdsjajjs.info/gate.php

https://idisaudhasdhasdj.info/gate.php

Attributes

build_id
28

rc4.plain

Targets

- Target
  
  e3932ab83bc05de2e91d321c4d479ff1aa3d10fdbd91e1687c80cc0ec88270e8
- Size
  
  111KB
- MD5
  
  e3564138588cba04c873bd054458f8b9
- SHA1
  
  157ec7421e1333b714d01a750b6d5d6517a92c45
- SHA256
  
  e3932ab83bc05de2e91d321c4d479ff1aa3d10fdbd91e1687c80cc0ec88270e8
- SHA512
  
  2a2e8ce45a928bcffdb40ebf6559c1f071bb3feccfd9cfe355e593acb559ecf84858cf4474708d311317ab08b3f981eba7c8b80dceae973839a0eec9049665c8
- SSDEEP
  
  1536:3ui/9Xb791Wff4K84oeRnobxxm2ShclQaLMin8F5vAC+WEQbAmTjTpeyv0+gPzff:H/J7jWHT/oegcaQF5XEgHbpeyvfgT
Score

10^/10

zloader dllobnova 1017 botnet persistence trojan
- Zloader, Terdot, DELoader, ZeusSphinx
  Zloader is a malware strain that was initially discovered back in August 2015.
  trojan botnet zloader
- Blocklisted process makes network request
- Adds Run key to start application
  persistence
- Suspicious use of SetThreadContext
behavioral1 behavioral2 behavioral3

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Targets

Zloader, Terdot, DELoader, ZeusSphinx

Blocklisted process makes network request

Adds Run key to start application

Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v6

Tasks

static1

behavioral1

behavioral2

behavioral3