Extracted

• • Target

    023f1ef0cc2c1e055b05ae1ff5bcc6bf2421003dea227aeb6d70c8a525fa3b82

  • Size

    2.6MB

  • MD5

    fb95561e8ed7289d015e945ad470e6db

  • SHA1

    03573bc869701cffd7c96e223633d46b0a23823a

  • SHA256

    023f1ef0cc2c1e055b05ae1ff5bcc6bf2421003dea227aeb6d70c8a525fa3b82

  • SHA512

    2a0bf4048c1a9eca9e13566b1512403b51462c8eb71cfb273225fbc221aa156a3d3eb571fa5328ff2f4e2ef7026b3e8847f0c0a739d8f989ba716efa411821a6

  • SSDEEP

    6144:sTlCgffOYPE99pqcLE9zn0HJGsfb7cwhl7e/:sJfWP9p1Lgzmbgye/

  Score

  10^/10

  zloaderpreffprefbotnetpersistencetrojan

  • Zloader, Terdot, DELoader, ZeusSphinx

    Zloader is a malware strain that was initially discovered back in August 2015.

    trojanbotnetzloader

  • Adds Run key to start application

    persistence

  • Blocklisted process makes network request

  • Suspicious use of SetThreadContext

  behavioral1behavioral2