Overview

overview

10

Static

static

3

bc0b57f04e...08.dll

windows7-x64

10

bc0b57f04e...08.dll

windows10-2004-x64

10

Resubmissions

08-12-2023 09:50

231208-lva8vsad95 10

05-02-2022 10:48

220205-mwes4sagdn 10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    bc0b57f04efe4239fcc02f049c97016c653c963de8cbe45bcf9449cd16919f08

  • Size

    452KB

  • Sample

    231208-lva8vsad95

  • MD5

    a87fab5ef51df54563c1752f4cc5b466

  • SHA1

    1e29f9771c034545e618cdb28e12f1004993f8bf

  • SHA256

    bc0b57f04efe4239fcc02f049c97016c653c963de8cbe45bcf9449cd16919f08

  • SHA512

    2369d6b6769853ff7246031bb7081261a6ecc67590e424f2845337291cc0a1241c24fc2ed340deb8f999befa5dea237df2000c5a0bf0f1e410d2394e0735df65

  • SSDEEP

    6144:lNOKA8716v7ae1wR/+0rtDVgfcw3vR2vRz5Datp8E2lv2avF:lsi716eGwIQDGfh3v+z5WtkR26

Score
10/10
zloadergoosdocretcryptbotnettrojan

Malware Config

Extracted

Family

zloader

Botnet

goosdoc

Campaign

retcrypt

C2

http://wmwifbajxxbcxmucxmlc.com/post.php

http://pwkqhdgytsshkoibaake.com/post.php

http://snnmnkxdhflwgthqismb.com/post.php

http://iawfqecrwohcxnhwtofa.com/post.php

http://nlbmfsyplohyaicmxhum.com/post.php

http://fvqlkgedqjiqgapudkgq.com/post.php

http://cmmxhurildiigqghlryq.com/post.php

http://nmqsmbiabjdnuushksas.com/post.php

http://fyratyubvflktyyjiqgq.com/post.php
Attributes
  • build_id

    117

rc4.plain

Targets

    • Target

      bc0b57f04efe4239fcc02f049c97016c653c963de8cbe45bcf9449cd16919f08

    • Size

      452KB

    • MD5

      a87fab5ef51df54563c1752f4cc5b466

    • SHA1

      1e29f9771c034545e618cdb28e12f1004993f8bf

    • SHA256

      bc0b57f04efe4239fcc02f049c97016c653c963de8cbe45bcf9449cd16919f08

    • SHA512

      2369d6b6769853ff7246031bb7081261a6ecc67590e424f2845337291cc0a1241c24fc2ed340deb8f999befa5dea237df2000c5a0bf0f1e410d2394e0735df65

    • SSDEEP

      6144:lNOKA8716v7ae1wR/+0rtDVgfcw3vR2vRz5Datp8E2lv2avF:lsi716eGwIQDGfh3v+z5WtkR26

    Score
    10/10
    zloadergoosdocretcryptbotnettrojan

    • Zloader, Terdot, DELoader, ZeusSphinx

      Zloader is a malware strain that was initially discovered back in August 2015.

      trojanbotnetzloader

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks