Extracted

• • Target

    a45285ccb16e3f56baf9d092245cf205

  • Size

    667KB

  • MD5

    a45285ccb16e3f56baf9d092245cf205

  • SHA1

    6b8a73888f211dc17e7ac7dd7e6952bd8bc94232

  • SHA256

    f00cb68eaca0ed077b858cb2211c72bd88c6e8c33c5ac395eca7af9811855dc2

  • SHA512

    c7ed9e2d37222820b8fdc4b8f00a72cf9cc5d7c83d12640b7f9dce68519cc90dd4eef64e0fd9494d0305a6871bae4f142289cf3d8c8e42d68123f068466e7c38

  • SSDEEP

    12288:/SNqyfHwQuzEa3IjYVzP/pBSZ6mxcSi+NsC1lV+9Evu15Jajj9B:/i1vwnn3/JgckNsQqEms

  Score

  10^/10

  zloaderdll26dll26botnetpersistencetrojan

  • Zloader, Terdot, DELoader, ZeusSphinx

    Zloader is a malware strain that was initially discovered back in August 2015.

    trojanbotnetzloader

  • Adds Run key to start application

    persistence

  • Blocklisted process makes network request

  • Suspicious use of SetThreadContext

  behavioral1behavioral2