Overview

overview

10

Static

static

3

Device/Har...da.dll

windows7-x64

10

Device/Har...da.dll

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    09_7d44bd7d83dace54b68f93ef16b7a70173dc9ccf

  • Size

    180KB

  • Sample

    240320-mft8vsed92

  • MD5

    5888013d8ed73ad7f59d11d8a191390f

  • SHA1

    4c6dff0f5ec5e20c6831de4764b2998e33be19cc

  • SHA256

    b37533b42dd24cc7efb7b1c4c71a70dac1a70623026e6c49dc50857b9e1f585c

  • SHA512

    83abafb5bf4cbc061a30bfa69dcaffc84f81a86f71446d5af989bd42585ad6d4d39ec279f43d41e7275e4557cd383f93be86f2d13fcf9e1287cae8470c4c2fbf

  • SSDEEP

    3072:c64PPeGgoWGtkTieoEAhFgS1yrN4XbmF4pT0bzQ7rYDBppR+2OWH5xMoiW2oyI1i:c64PWjokTieTwgAyryXbO4FIErYK2OW4

Score
10/10
zloadermain26.04.2020botnetpersistencetrojan

Malware Config

Extracted

Family

zloader

Botnet

main

Campaign

26.04.2020

C2

https://coult.org/sound.php

https://chorbly.org/sound.php

https://kodray.org/sound.php

https://retualeigh.com/sound.php

https://grually.com/sound.php

https://footmess.com/sound.php

https://rarigussa.com/sound.php

https://pacallse.com/sound.php
Attributes
  • build_id

    47

rc4.plain

Targets

    • Target

      Device/HarddiskVolume7/imaginaryC2-master/examples/use-case-9-zloader/zloader-imaginary-c2/server_data/09_7d44bd7d83dace54b68f93ef16b7a70173dc9ccf

    • Size

      838KB

    • MD5

      57138593c18492f813e426719ebed2e8

    • SHA1

      7d44bd7d83dace54b68f93ef16b7a70173dc9ccf

    • SHA256

      d0226de456f5fb75ae7588d57bb9368848aa01afae86893d6da2b95098080c97

    • SHA512

      57097f8dea1681713ebe983f2e1829ea21536c1bb867865b65ce8497fca67ca89ae148f0a77bdd9c5622b60b29344a83bfea9b09cbf388336c764840b5e32daa

    • SSDEEP

      6144:oxG3wZYnmy+9Mw6PeJ/Oubatb6pf4Pbjmr9UnbNzLLxsw:NwZYn72hSS9gbNzLLOw

    Score
    10/10
    zloadermain26.04.2020botnetpersistencetrojan

    • Zloader, Terdot, DELoader, ZeusSphinx

      Zloader is a malware strain that was initially discovered back in August 2015.

      trojanbotnetzloader

    • Adds Run key to start application

      persistence

    • Blocklisted process makes network request

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Defense Evasion

Modify Registry

1
T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Tasks