Overview

overview

10

Static

static

3

22c1b89400...18.dll

windows7-x64

10

22c1b89400...18.dll

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    22c1b894002c6ffd1fdc2a75b48ddcda_JaffaCakes118
  • Size 723KB
  • Sample240508-cmpa3sfg56
  • SHA256 c91229d90c423cd5b5bf870cec714e5c956058c62f4b2036607d44f1767c50d2
  • MD5 SHA1 SHA512 SSDEEP
Score
10/10
zloaderbat1k3bat1k3botnettrojan

Malware Config

Extracted

Family

  • zloader

Botnet

  • bat1k3

Campaign

  • bat1k3

C2

  • http://as9897234135.xyz/LKhwojehDgwegSDG/gateJKjdsh.php

  • http://as9897234135.org/LKhwojehDgwegSDG/gateJKjdsh.php

  • http://as9897234135.net/LKhwojehDgwegSDG/gateJKjdsh.php

  • http://as9897234135.in/LKhwojehDgwegSDG/gateJKjdsh.php

  • http://as9897234135.com/LKhwojehDgwegSDG/gateJKjdsh.php

Attributes
  • build_id

    37

rc4.plain
rsa_pubkey.plain

Targets

    • Target
      22c1b894002c6ffd1fdc2a75b48ddcda_JaffaCakes118
    • Size 723KB
    • SHA256 c91229d90c423cd5b5bf870cec714e5c956058c62f4b2036607d44f1767c50d2
    • MD5 SHA1 SHA512 SSDEEP
    Score
    10/10
    zloaderbat1k3bat1k3botnettrojan

    • Suspicious use of NtCreateUserProcessOtherParentProcess

    • Zloader, Terdot, DELoader, ZeusSphinx

      Zloader is a malware strain that was initially discovered back in August 2015.

      trojanbotnetzloader

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks