Overview

overview

10

Static

static

3

Device/Har...da.dll

windows7-x64

10

Device/Har...da.dll

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    09_7d44bd7d83dace54b68f93ef16b7a70173dc9ccf
  • Size 180KB
  • Sample240320-mft8vsed92
  • SHA256 b37533b42dd24cc7efb7b1c4c71a70dac1a70623026e6c49dc50857b9e1f585c
  • MD5 SHA1 SHA512 SSDEEP
Score
10/10
zloadermain26.04.2020botnetpersistencetrojan

Malware Config

Extracted

Family

  • zloader

Botnet

  • main

Campaign

  • 26.04.2020

C2

  • https://coult.org/sound.php

  • https://chorbly.org/sound.php

  • https://kodray.org/sound.php

  • https://retualeigh.com/sound.php

  • https://grually.com/sound.php

  • https://footmess.com/sound.php

  • https://rarigussa.com/sound.php

  • https://pacallse.com/sound.php

Attributes
  • build_id

    47

rc4.plain

Targets

    • Target
      Device/HarddiskVolume7/imaginaryC2-master/examples/use-case-9-zloader/zloader-imaginary-c2/server_data/09_7d44bd7d83dace54b68f93ef16b7a70173dc9ccf
    • Size 838KB
    • SHA256 d0226de456f5fb75ae7588d57bb9368848aa01afae86893d6da2b95098080c97
    • MD5 SHA1 SHA512 SSDEEP
    Score
    10/10
    zloadermain26.04.2020botnetpersistencetrojan

    • Zloader, Terdot, DELoader, ZeusSphinx

      Zloader is a malware strain that was initially discovered back in August 2015.

      trojanbotnetzloader

    • Adds Run key to start application

      persistence

    • Blocklisted process makes network request

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks