Overview

overview

10

Static

static

3

zloader 2_....0.exe

windows7-x64

10

zloader 2_....0.exe

windows10-2004-x64

10

Resubmissions

19-07-2023 11:14

230719-nb99yscg87 10

19-07-2020 19:33

200719-m964m1njqe 10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    zloader 2_1.0.13.0.vir

  • Size

    154KB

  • Sample

    230719-nb99yscg87

  • MD5

    07e6b50724981e0c96f7d23f48d309b5

  • SHA1

    0c012857690e0eebf10eb0ccafcbad9434f99d91

  • SHA256

    21f41071eb31d4b4f2fb1e5d9be035014b1302313804e46077ca23da0dd30bc8

  • SHA512

    e930617c54fee9fbc9cfb37d6a014e808556f55306d50e2b83c81ef9478772ff4be4e86d55f03879ab5d0cba6a796268dbfb9ac06b2350502bbf56286dc83102

  • SSDEEP

    3072:NOgSKE2Om5C3nAnpedwh6cXtoqnDqQ8CrE6mA3b77BJDg:MgSKEhmcQnpSwh6cu0T8CY6mA3/7X

Score
10/10
zloadervlenie2020obnova20botnetpersistencetrojan

Malware Config

Extracted

Family

zloader

Botnet

vlenie2020

Campaign

obnova20

C2

https://dasifosafjasfhasf.com/gate.php

https://kasfajfsafhasfhaf.com/gate.php

https://fdsjfjdsfjdsjfdjsfh.com/gate.php

https://fdsjfjdsfjdsdsjajjs.com/gate.php

https://idisaudhasdhasdj.com/gate.php

https://dsjdjsjdsadhasdas.com/gate.php

https://dsdjfhdsufudhjas.com/gate.php
Attributes
  • build_id

    1869505135

rc4.plain

Targets

    • Target

      zloader 2_1.0.13.0.vir

    • Size

      154KB

    • MD5

      07e6b50724981e0c96f7d23f48d309b5

    • SHA1

      0c012857690e0eebf10eb0ccafcbad9434f99d91

    • SHA256

      21f41071eb31d4b4f2fb1e5d9be035014b1302313804e46077ca23da0dd30bc8

    • SHA512

      e930617c54fee9fbc9cfb37d6a014e808556f55306d50e2b83c81ef9478772ff4be4e86d55f03879ab5d0cba6a796268dbfb9ac06b2350502bbf56286dc83102

    • SSDEEP

      3072:NOgSKE2Om5C3nAnpedwh6cXtoqnDqQ8CrE6mA3b77BJDg:MgSKEhmcQnpSwh6cu0T8CY6mA3/7X

    Score
    10/10
    zloadervlenie2020obnova20botnetpersistencetrojan

    • Zloader, Terdot, DELoader, ZeusSphinx

      Zloader is a malware strain that was initially discovered back in August 2015.

      trojanbotnetzloader

    • Blocklisted process makes network request

    • Adds Run key to start application

      persistence

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks