Overview

overview

10

Static

static

10

835048e00b...47.exe

windows7-x64

10

835048e00b...47.exe

windows10-2004-x64

10

Resubmissions

24-01-2024 08:44

240124-kne3ssecfm 10

24-01-2024 08:20

240124-j8dvssdgen 10

23-01-2024 11:38

240123-nryabshhbk 10

05-02-2022 13:33

220205-qtgrgabgg4 10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    835048e00ba3babf6f920c9a4c2863865a5dcf8e0b6ede4f57c63aeb9cb5c147

  • Size

    184KB

  • MD5

    c844efe1b7e76cbdea36ce62ff788de9

  • SHA1

    d8143cf09bff7b0ca2a0c777912746a5922104ee

  • SHA256

    835048e00ba3babf6f920c9a4c2863865a5dcf8e0b6ede4f57c63aeb9cb5c147

  • SHA512

    52b350965940c785c0a9f3991016ee14a303d49a4168bf5c008bbaafe301cd93e7201965ced9f1e8cdf5f31414c128fdc546461ff21af45c9ae17c3f462d4931

  • SSDEEP

    3072:brenHphylBa5vbUVmpg+Rrf17JhNO429gs6F4FO7MvA+lVJeTf7ko2bCHkMwGAkI:UglEzu+pxJhNC9gsxFO7idlzaQo2bVlt

Score
10/10
telegramcryptantiamsidoczloader

Malware Config

Extracted

Family

zloader

Botnet

TelegramCrypt

Campaign

AntiAMSIdoc

C2

http://wmwifbajxxbcxmucxmlc.com/post.php

http://pwkqhdgytsshkoibaake.com/post.php

http://snnmnkxdhflwgthqismb.com/post.php

http://iawfqecrwohcxnhwtofa.com/post.php

http://nlbmfsyplohyaicmxhum.com/post.php

http://fvqlkgedqjiqgapudkgq.com/post.php

http://cmmxhurildiigqghlryq.com/post.php

http://nmqsmbiabjdnuushksas.com/post.php

http://fyratyubvflktyyjiqgq.com/post.php
Attributes
  • build_id

    115

rc4.plain

Signatures

  • Zloader family
    zloader
  • Unsigned PE 1 IoCs

    Checks for missing Authenticode signature.

Files

  • 835048e00ba3babf6f920c9a4c2863865a5dcf8e0b6ede4f57c63aeb9cb5c147
    .exe windows:5 windows x86 arch:x86

    aeaf05baf5176b03e6ca1c1b0c09e695


    Headers

    Imports

    Sections