Overview

overview

10

Static

static

3

1ea43f2b75...6c.dll

windows7-x64

10

1ea43f2b75...6c.dll

windows10-2004-x64

10

Resubmissions

31-10-2023 09:33

231031-ljbegshb67 10

27-10-2022 06:35

221027-hch9zabcd5 10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    1ea43f2b7589f266a7574e987b3a5c80634060fc2d1fe0eae77410c76dea326c

  • Size

    438KB

  • Sample

    231031-ljbegshb67

  • MD5

    8688f0253256e5c6cfc27a3801e6077b

  • SHA1

    9364679fa1142dd15759fc22ed3d15b65ab447b2

  • SHA256

    1ea43f2b7589f266a7574e987b3a5c80634060fc2d1fe0eae77410c76dea326c

  • SHA512

    e7c6256b57869817dade08cb8ef706fa688e27f1d6cda8894c7bd19e4abf23149d83347d3748f9cee08cb3333282ff295291700484f5b2b3d9834b684b9c7aa9

  • SSDEEP

    12288:/4B8qIBi/bdOcteKcEAUg+tAiYBNnyPEfYIzUY:gBnIBiTxzLADiSnyPlz

Score
10/10
zloaderbotnet1new_1botnetpersistencetrojan

Malware Config

Extracted

Family

zloader

Botnet

Botnet1

Campaign

new_1

C2

https://representis.xyz/noagate.php

https://representis.icu/noagate.php
Attributes
  • build_id

    1

rc4.plain

Targets

    • Target

      1ea43f2b7589f266a7574e987b3a5c80634060fc2d1fe0eae77410c76dea326c

    • Size

      438KB

    • MD5

      8688f0253256e5c6cfc27a3801e6077b

    • SHA1

      9364679fa1142dd15759fc22ed3d15b65ab447b2

    • SHA256

      1ea43f2b7589f266a7574e987b3a5c80634060fc2d1fe0eae77410c76dea326c

    • SHA512

      e7c6256b57869817dade08cb8ef706fa688e27f1d6cda8894c7bd19e4abf23149d83347d3748f9cee08cb3333282ff295291700484f5b2b3d9834b684b9c7aa9

    • SSDEEP

      12288:/4B8qIBi/bdOcteKcEAUg+tAiYBNnyPEfYIzUY:gBnIBiTxzLADiSnyPlz

    Score
    10/10
    zloaderbotnet1new_1botnetpersistencetrojan

    • Zloader, Terdot, DELoader, ZeusSphinx

      Zloader is a malware strain that was initially discovered back in August 2015.

      trojanbotnetzloader

    • Adds Run key to start application

      persistence

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Defense Evasion

Modify Registry

1
T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Tasks