Overview

overview

10

Static

static

10

835048e00b...47.exe

windows7-x64

10

835048e00b...47.exe

windows10-2004-x64

10

Resubmissions

24-01-2024 08:44

240124-kne3ssecfm 10

24-01-2024 08:20

240124-j8dvssdgen 10

23-01-2024 11:38

240123-nryabshhbk 10

05-02-2022 13:33

220205-qtgrgabgg4 10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    835048e00ba3babf6f920c9a4c2863865a5dcf8e0b6ede4f57c63aeb9cb5c147

  • Size

    184KB

  • Sample

    240123-nryabshhbk

  • MD5

    c844efe1b7e76cbdea36ce62ff788de9

  • SHA1

    d8143cf09bff7b0ca2a0c777912746a5922104ee

  • SHA256

    835048e00ba3babf6f920c9a4c2863865a5dcf8e0b6ede4f57c63aeb9cb5c147

  • SHA512

    52b350965940c785c0a9f3991016ee14a303d49a4168bf5c008bbaafe301cd93e7201965ced9f1e8cdf5f31414c128fdc546461ff21af45c9ae17c3f462d4931

  • SSDEEP

    3072:brenHphylBa5vbUVmpg+Rrf17JhNO429gs6F4FO7MvA+lVJeTf7ko2bCHkMwGAkI:UglEzu+pxJhNC9gsxFO7idlzaQo2bVlt

Score
10/10
zloadertelegramcryptantiamsidocbotnettrojan

Malware Config

Extracted

Family

zloader

Botnet

TelegramCrypt

Campaign

AntiAMSIdoc

C2

http://wmwifbajxxbcxmucxmlc.com/post.php

http://pwkqhdgytsshkoibaake.com/post.php

http://snnmnkxdhflwgthqismb.com/post.php

http://iawfqecrwohcxnhwtofa.com/post.php

http://nlbmfsyplohyaicmxhum.com/post.php

http://fvqlkgedqjiqgapudkgq.com/post.php

http://cmmxhurildiigqghlryq.com/post.php

http://nmqsmbiabjdnuushksas.com/post.php

http://fyratyubvflktyyjiqgq.com/post.php
Attributes
  • build_id

    115

rc4.plain

Targets

    • Target

      835048e00ba3babf6f920c9a4c2863865a5dcf8e0b6ede4f57c63aeb9cb5c147

    • Size

      184KB

    • MD5

      c844efe1b7e76cbdea36ce62ff788de9

    • SHA1

      d8143cf09bff7b0ca2a0c777912746a5922104ee

    • SHA256

      835048e00ba3babf6f920c9a4c2863865a5dcf8e0b6ede4f57c63aeb9cb5c147

    • SHA512

      52b350965940c785c0a9f3991016ee14a303d49a4168bf5c008bbaafe301cd93e7201965ced9f1e8cdf5f31414c128fdc546461ff21af45c9ae17c3f462d4931

    • SSDEEP

      3072:brenHphylBa5vbUVmpg+Rrf17JhNO429gs6F4FO7MvA+lVJeTf7ko2bCHkMwGAkI:UglEzu+pxJhNC9gsxFO7idlzaQo2bVlt

    Score
    10/10
    zloadertelegramcryptantiamsidocbotnettrojan

    • Zloader, Terdot, DELoader, ZeusSphinx

      Zloader is a malware strain that was initially discovered back in August 2015.

      trojanbotnetzloader

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks