Overview

overview

10

Static

static

10

e3932ab83b...e8.dll

windows7-x64

10

e3932ab83b...e8.dll

windows10-1703-x64

10

e3932ab83b...e8.dll

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    e3932ab83bc05de2e91d321c4d479ff1aa3d10fdbd91e1687c80cc0ec88270e8.zip

  • Size

    70KB

  • Sample

    221226-qpgkxagb8t

  • MD5

    1647195938228c7e5aa08ba3087f0a70

  • SHA1

    3b6149a74dad462649dba9a001c04adccdfa7d85

  • SHA256

    461bc141026278f75214983abeafe0ce0d9be8750ee5847e858d8e56a70eefbd

  • SHA512

    dc535439f6cb7f1c169a5c6838c9be5899c2e492d18027a6d208b3af5ac150ea6afccebeb8c8656bb36a2dc8df30953b0620946450809aa64a5996f338efdb82

  • SSDEEP

    1536:mBtQWdV0lCRdiDgWLLDfM5iF+5ua8noKwJzjm44ZOncLeQ:0QWdV0lQDYP0cEQaqodmX0c9

Score
10/10
zloaderdllobnova1017botnetpersistencetrojan

Malware Config

Extracted

Family

zloader

Botnet

DLLobnova

Campaign

1017

C2

https://fdsjfjdsfjdsjfdjsfh.com/gate.php

https://fdsjfjdsfjdsdsjajjs.com/gate.php

https://idisaudhasdhasdj.com/gate.php

https://dsjdjsjdsadhasdas.com/gate.php

https://dsdjfhdsufudhjas.com/gate.php

https://dsdjfhdsufudhjas.info/gate.php

https://fdsjfjdsfjdsdsjajjs.info/gate.php

https://idisaudhasdhasdj.info/gate.php
Attributes
  • build_id

    28

rc4.plain

Targets

    • Target

      e3932ab83bc05de2e91d321c4d479ff1aa3d10fdbd91e1687c80cc0ec88270e8

    • Size

      111KB

    • MD5

      e3564138588cba04c873bd054458f8b9

    • SHA1

      157ec7421e1333b714d01a750b6d5d6517a92c45

    • SHA256

      e3932ab83bc05de2e91d321c4d479ff1aa3d10fdbd91e1687c80cc0ec88270e8

    • SHA512

      2a2e8ce45a928bcffdb40ebf6559c1f071bb3feccfd9cfe355e593acb559ecf84858cf4474708d311317ab08b3f981eba7c8b80dceae973839a0eec9049665c8

    • SSDEEP

      1536:3ui/9Xb791Wff4K84oeRnobxxm2ShclQaLMin8F5vAC+WEQbAmTjTpeyv0+gPzff:H/J7jWHT/oegcaQF5XEgHbpeyvfgT

    Score
    10/10
    zloaderdllobnova1017botnetpersistencetrojan

    • Zloader, Terdot, DELoader, ZeusSphinx

      Zloader is a malware strain that was initially discovered back in August 2015.

      trojanbotnetzloader

    • Blocklisted process makes network request

    • Adds Run key to start application

      persistence

    • Suspicious use of SetThreadContext

    behavioral1behavioral2behavioral3

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1
T1060

Privilege Escalation

Defense Evasion

Modify Registry

1
T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks