hxxp://zapdoszulu[.]proboards[.]com

- Target
  
  http://zapdoszulu.proboards.com
Score

8^/10

discovery persistence spyware stealer
- Contacts a large (572) amount of remote hosts
  This may indicate a network scan to discover remotely running services.
  discovery
- Modifies Installed Components in the registry
  persistence
- Sets file execution options in registry
  persistence
- Executes dropped EXE
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Registers COM server for autorun
  persistence
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Legitimate hosting services abused for malware hosting/C2
- Drops file in System32 directory
behavioral1