Overview

overview

10

Static

static

3

915fcafe99...df.dll

windows7-x64

10

915fcafe99...df.dll

windows10-2004-x64

10

Resubmissions

05-02-2022 12:51

220205-p3t8gsbeb2 10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    915fcafe990b9110a4e0994d37f8beda66e80aba5174e686bc1d4de13836a7df

  • Size

    421KB

  • Sample

    231208-lttc2sbg41

  • MD5

    897827f98772919254d6b257d8b8fc11

  • SHA1

    3752186f6b38c55aa49aa9cbc895fbbe4328b869

  • SHA256

    915fcafe990b9110a4e0994d37f8beda66e80aba5174e686bc1d4de13836a7df

  • SHA512

    e0a82d23955bbb9716f5fabf6007e9086d466aac2f0606347bf4234e16119bbfe8b9cb45ef3ba7a93acd9f915785245c383f53d1c662dfe2253d26c5f6e92bba

  • SSDEEP

    6144:tZXN7SUy8WA3gha780p2F2V6voOy5Gn7n0O8N5WYeXmseY1rmWd2KWJ:tjSUyhA30a78rQqIN5te20qWd2KWJ

Score
10/10
zloaderapril23fixedapril23fixedbotnettrojan

Malware Config

Extracted

Family

zloader

Botnet

April23Fixed

Campaign

April23Fixed

C2

http://wmwifbajxxbcxmucxmlc.com/post.php

http://onfovdaqqrwbvdfoqnof.com/post.php

http://cmmxhurildiigqghlryq.com/post.php

http://nmqsmbiabjdnuushksas.com/post.php

http://fvqlkgedqjiqgapudkgq.com/post.php

http://iawfqecrwohcxnhwtofa.com/post.php

http://nlbmfsyplohyaicmxhum.com/post.php

http://snnmnkxdhflwgthqismb.com/post.php
Attributes
  • build_id

    120

rc4.plain

Targets

    • Target

      915fcafe990b9110a4e0994d37f8beda66e80aba5174e686bc1d4de13836a7df

    • Size

      421KB

    • MD5

      897827f98772919254d6b257d8b8fc11

    • SHA1

      3752186f6b38c55aa49aa9cbc895fbbe4328b869

    • SHA256

      915fcafe990b9110a4e0994d37f8beda66e80aba5174e686bc1d4de13836a7df

    • SHA512

      e0a82d23955bbb9716f5fabf6007e9086d466aac2f0606347bf4234e16119bbfe8b9cb45ef3ba7a93acd9f915785245c383f53d1c662dfe2253d26c5f6e92bba

    • SSDEEP

      6144:tZXN7SUy8WA3gha780p2F2V6voOy5Gn7n0O8N5WYeXmseY1rmWd2KWJ:tjSUyhA30a78rQqIN5te20qWd2KWJ

    Score
    10/10
    zloaderapril23fixedapril23fixedbotnettrojan

    • Zloader, Terdot, DELoader, ZeusSphinx

      Zloader is a malware strain that was initially discovered back in August 2015.

      trojanbotnetzloader

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks