Overview

overview

10

Static

static

3

3b4b2c5c8a...d9.dll

windows7-x64

10

3b4b2c5c8a...d9.dll

windows10-2004-x64

10

Resubmissions

08-12-2023 09:45

231208-lrje3aad83 10

05-02-2022 16:42

220205-t7syfadda8 10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    3b4b2c5c8a00fab59684fee37b54912c58682022e2dc4e3dcd24b6e58533ecd9

  • Size

    421KB

  • Sample

    231208-lrje3aad83

  • MD5

    061506b2a0a26fbd20dba69a1105e1b7

  • SHA1

    a4f4bc27be3da2b85a06883615bb96b8a2a79ebb

  • SHA256

    3b4b2c5c8a00fab59684fee37b54912c58682022e2dc4e3dcd24b6e58533ecd9

  • SHA512

    4426c072cb52f2e4ce35ca88c4f20304145d017b5e95f2d35aa68216691b6abde99b6941e1067e50b77342300dea329cb0facbc5ab391272ced658dcf5ee2be9

  • SSDEEP

    6144:tZXN7S2y8WA3gha780p2F2V6voOy5Gn7n0O8N5WYeXmseY1rmWd2KWJ:tjS2yhA30a78rQqIN5te20qWd2KWJ

Score
10/10
zloaderapril23fixedapril23fixedbotnettrojan

Malware Config

Extracted

Family

zloader

Botnet

April23Fixed

Campaign

April23Fixed

C2

http://wmwifbajxxbcxmucxmlc.com/post.php

http://onfovdaqqrwbvdfoqnof.com/post.php

http://cmmxhurildiigqghlryq.com/post.php

http://nmqsmbiabjdnuushksas.com/post.php

http://fvqlkgedqjiqgapudkgq.com/post.php

http://iawfqecrwohcxnhwtofa.com/post.php

http://nlbmfsyplohyaicmxhum.com/post.php

http://snnmnkxdhflwgthqismb.com/post.php
Attributes
  • build_id

    120

rc4.plain

Targets

    • Target

      3b4b2c5c8a00fab59684fee37b54912c58682022e2dc4e3dcd24b6e58533ecd9

    • Size

      421KB

    • MD5

      061506b2a0a26fbd20dba69a1105e1b7

    • SHA1

      a4f4bc27be3da2b85a06883615bb96b8a2a79ebb

    • SHA256

      3b4b2c5c8a00fab59684fee37b54912c58682022e2dc4e3dcd24b6e58533ecd9

    • SHA512

      4426c072cb52f2e4ce35ca88c4f20304145d017b5e95f2d35aa68216691b6abde99b6941e1067e50b77342300dea329cb0facbc5ab391272ced658dcf5ee2be9

    • SSDEEP

      6144:tZXN7S2y8WA3gha780p2F2V6voOy5Gn7n0O8N5WYeXmseY1rmWd2KWJ:tjS2yhA30a78rQqIN5te20qWd2KWJ

    Score
    10/10
    zloaderapril23fixedapril23fixedbotnettrojan

    • Zloader, Terdot, DELoader, ZeusSphinx

      Zloader is a malware strain that was initially discovered back in August 2015.

      trojanbotnetzloader

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks