Overview

overview

10

Static

static

3

A004BC8B4F...B1.dll

windows7-x64

10

A004BC8B4F...B1.dll

windows10-2004-x64

10

Resubmissions

31-01-2024 21:42

240131-1ktpsadab6 10

24-01-2024 07:47

240124-jml92sdcd6 10

23-01-2024 11:54

240123-n25r6ahhfk 10

24-06-2020 13:36

200624-enc457kzrj 10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    A004BC8B4F3DB1EF5A66579B9746B5B1.bin

  • Size

    424KB

  • Sample

    240131-1ktpsadab6

  • MD5

    a004bc8b4f3db1ef5a66579b9746b5b1

  • SHA1

    88a5fcebfd7a037a9ca9573772ac2334a61b25de

  • SHA256

    42bb5eae534eb2cea979c300b797a65febf291b28aea0b9d8bbea7d0a41bffa2

  • SHA512

    28aed111b2ecea90c2da03871f36272b8680d392c245fdf0e2f4d4454974a3a51d6744133cecfc2576bbc778742f9b824e8355026b53d029d13ff79bb2136f9b

  • SSDEEP

    6144:kQ0fpRug1NzpAhY2Zgi1ny2YT2oqCesyc+V6pDDW3FdREH5gH+xWz1:kQ0Rsg58Yti9y2voysiVmO3BlH+W

Score
10/10
zloaderjune18newretjunebotnettrojan

Malware Config

Extracted

Family

zloader

Botnet

June18newret

Campaign

June

C2

http://snnmnkxdhflwgthqismb.com/web/post.php

http://nlbmfsyplohyaicmxhum.com/web/post.php

http://softwareserviceupdater1.com/web/post.php

http://softwareserviceupdater2.com/web/post.php
Attributes
  • build_id

    3

rc4.plain
rsa_pubkey.plain

Targets

    • Target

      A004BC8B4F3DB1EF5A66579B9746B5B1.bin

    • Size

      424KB

    • MD5

      a004bc8b4f3db1ef5a66579b9746b5b1

    • SHA1

      88a5fcebfd7a037a9ca9573772ac2334a61b25de

    • SHA256

      42bb5eae534eb2cea979c300b797a65febf291b28aea0b9d8bbea7d0a41bffa2

    • SHA512

      28aed111b2ecea90c2da03871f36272b8680d392c245fdf0e2f4d4454974a3a51d6744133cecfc2576bbc778742f9b824e8355026b53d029d13ff79bb2136f9b

    • SSDEEP

      6144:kQ0fpRug1NzpAhY2Zgi1ny2YT2oqCesyc+V6pDDW3FdREH5gH+xWz1:kQ0Rsg58Yti9y2voysiVmO3BlH+W

    Score
    10/10
    zloaderjune18newretjunebotnettrojan

    • Zloader, Terdot, DELoader, ZeusSphinx

      Zloader is a malware strain that was initially discovered back in August 2015.

      trojanbotnetzloader

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks