Overview

overview

10

Static

static

3

8a46f0c4be...18.dll

windows7-x64

10

8a46f0c4be...18.dll

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    8a46f0c4be8a91b533142a112618a885_JaffaCakes118
  • Size 448KB
  • Sample240601-m7bktsbe95
  • SHA256 903c3b246b516395e8aaca0c647d496005d9d6609107f7f67a061b5390608010
  • MD5 SHA1 SHA512 SSDEEP
Score
10/10
zloaderbat1k3bat1k3botnettrojan

Malware Config

Extracted

Family

  • zloader

Botnet

  • bat1k3

Campaign

  • bat1k3

C2

  • http://ad123234234.in/LKhwojehDgwegSDG/gateJKjdsh.php

  • http://ad123234234.info/LKhwojehDgwegSDG/gateJKjdsh.php

  • http://ad123234234.net/LKhwojehDgwegSDG/gateJKjdsh.php

  • http://ad123234234.org/LKhwojehDgwegSDG/gateJKjdsh.php

  • http://ad123234234.xyz/LKhwojehDgwegSDG/gateJKjdsh.php

Attributes
  • build_id

    29

rc4.plain
rsa_pubkey.plain

Targets

    • Target
      8a46f0c4be8a91b533142a112618a885_JaffaCakes118
    • Size 448KB
    • SHA256 903c3b246b516395e8aaca0c647d496005d9d6609107f7f67a061b5390608010
    • MD5 SHA1 SHA512 SSDEEP
    Score
    10/10
    zloaderbat1k3bat1k3botnettrojan

    • Suspicious use of NtCreateUserProcessOtherParentProcess

    • Zloader, Terdot, DELoader, ZeusSphinx

      Zloader is a malware strain that was initially discovered back in August 2015.

      trojanbotnetzloader

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks