Overview

overview

10

Static

static

44ede6e1b9...0b.dll

windows7-x64

10

44ede6e1b9...0b.dll

windows10-1703-x64

10

44ede6e1b9...0b.dll

windows10-2004-x64

10

Resubmissions

26-12-2022 13:32

221226-qtbkfsda54 10

04-08-2022 21:18

220804-z5qcesbae2 10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    44ede6e1b9be1c013f13d82645f7a9cff7d92b267778f19b46aa5c1f7fa3c10b

  • Size

    570KB

  • Sample

    221226-qtbkfsda54

  • MD5

    3f2036d6638df7dbeeaacd45d52c007b

  • SHA1

    fc747b3049c96afde43d91e6089da7d3865931b9

  • SHA256

    44ede6e1b9be1c013f13d82645f7a9cff7d92b267778f19b46aa5c1f7fa3c10b

  • SHA512

    7c48919e37abc7fb927f93b159f1b262e4168785f5f12a3b64f8d09a0c912f0a9af534a3343b5fdcf5b40bc437aa9b7308703d37be6022450733b46f6ccbfc8e

  • SSDEEP

    6144:oUCE98sDXeHfijLo9qLV+yJqG3OOU0qs4wLjqonWpWjaBQY:LCS6HQSmlqGW0EwLtWwe7

Score
10/10
zloaderdivaderxls_s_2010botnettrojan

Malware Config

Extracted

Family

zloader

Botnet

divader

Campaign

xls_s_2010

C2

https://kochamkkkras.ru/gate.php

https://uookqihwdid.ru/gate.php

https://iqowijsdakm.ru/gate.php

https://wiewjdmkfjn.ru/gate.php

https://dksaoidiakjd.su/gate.php

https://iweuiqjdakjd.su/gate.php

https://yuidskadjna.su/gate.php

https://olksmadnbdj.su/gate.php

https://odsakmdfnbs.su/gate.php

https://odsakjmdnhsaj.su/gate.php
Attributes
  • build_id

    133

rc4.plain
rsa_pubkey.plain

Targets

    • Target

      44ede6e1b9be1c013f13d82645f7a9cff7d92b267778f19b46aa5c1f7fa3c10b

    • Size

      570KB

    • MD5

      3f2036d6638df7dbeeaacd45d52c007b

    • SHA1

      fc747b3049c96afde43d91e6089da7d3865931b9

    • SHA256

      44ede6e1b9be1c013f13d82645f7a9cff7d92b267778f19b46aa5c1f7fa3c10b

    • SHA512

      7c48919e37abc7fb927f93b159f1b262e4168785f5f12a3b64f8d09a0c912f0a9af534a3343b5fdcf5b40bc437aa9b7308703d37be6022450733b46f6ccbfc8e

    • SSDEEP

      6144:oUCE98sDXeHfijLo9qLV+yJqG3OOU0qs4wLjqonWpWjaBQY:LCS6HQSmlqGW0EwLtWwe7

    Score
    10/10
    zloaderdivaderxls_s_2010botnettrojan

    • Zloader, Terdot, DELoader, ZeusSphinx

      Zloader is a malware strain that was initially discovered back in August 2015.

      trojanbotnetzloader
    behavioral1behavioral2behavioral3

MITRE ATT&CK Matrix

Tasks