zloader | a1941786149857faebfd4f2731022d8af6aaa984b981bffd40bd123472b0beb4

Sharing

Copy URL

Twitter E-mail

General

Target

Battly-Launcher-Windows.exe
Size

183.1MB
Sample

240701-z6vcrszgla
MD5

777dae8f41c5c9ba97b798fcd52612de
SHA1

03ec3ee7b1e1a47dc8b0e7f5f980ebd7071c469b
SHA256

a1941786149857faebfd4f2731022d8af6aaa984b981bffd40bd123472b0beb4
SHA512

792ccba986338f3a3d5475d615fa276a73c52eb483484ee2fda16a143f1100afdfd0dea2bb309bfba54202e07707df7bb025677f6477bf44ddb8f2282093f592
SSDEEP

3145728:qJcuNt6i+X0MdTUPo+YFawtU4odz5zA436E7IkGl0BkChNw5+VTmms+B6Q8k:ScuN7+QYFjmPz5zAJ0wahNw5+VTTs+Bl

Score

10^/10

zloader

Malware Config

Targets

- Target
  
  Battly-Launcher-Windows.exe
- Size
  
  183.1MB
- MD5
  
  777dae8f41c5c9ba97b798fcd52612de
- SHA1
  
  03ec3ee7b1e1a47dc8b0e7f5f980ebd7071c469b
- SHA256
  
  a1941786149857faebfd4f2731022d8af6aaa984b981bffd40bd123472b0beb4
- SHA512
  
  792ccba986338f3a3d5475d615fa276a73c52eb483484ee2fda16a143f1100afdfd0dea2bb309bfba54202e07707df7bb025677f6477bf44ddb8f2282093f592
- SSDEEP
  
  3145728:qJcuNt6i+X0MdTUPo+YFawtU4odz5zA436E7IkGl0BkChNw5+VTmms+B6Q8k:ScuN7+QYFjmPz5zAJ0wahNw5+VTTs+Bl
Score

7^/10
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
behavioral1 behavioral2
- Target
  
  resources/app/node_modules/async/bower.json
- Size
  
  239B
- MD5
  
  7c9c6b878a12876e602e07c2fe15231a
- SHA1
  
  ad6e412a24fd1c1a7e7e6b1654e6ae2560f9ec07
- SHA256
  
  a3e2209912611b3f28ada407deac23712a8c3702ca53b1ee0569a613d4c6f227
- SHA512
  
  099d4e1df45c440bb3e6279843cad0151432e2488d1fe97204d55cf13019e442b0b7d294ec92d0ffab5b7c04ccc5e11ea02cbd54f9347244c455270bf1b6c722
Score

3^/10
behavioral3 behavioral4
- Target
  
  resources/app/node_modules/balanced-match/LICENSE.md
- Size
  
  1KB
- MD5
  
  7fa99ddc3424107350ca6e9a24552085
- SHA1
  
  09013c002fbdd686da2ec13c5a6d014f0a294ba9
- SHA256
  
  a1bd5deadb6a06dd74efa852c1b8b23f63b67f2214fbe9c8bd591da51da69268
- SHA512
  
  389651cc725f7fa28dfb45e5de84e232212618f4adc187443956c8725e5684f39dd25bf040f95513d17675ed2de7188fa110e669b91987ad956a95c224acc251
Score

3^/10
behavioral5 behavioral6
- Target
  
  resources/app/node_modules/balanced-match/package.json
- Size
  
  891B
- MD5
  
  0130280bf90eac1705fff7300dbacb2d
- SHA1
  
  6d6b92d1267c374384bac32a0a8d435b762b852a
- SHA256
  
  b4cfa3b375d23e8e979227e68db4d4ea1e810328458c78390886f2fd1df5740e
- SHA512
  
  5dec31f3125b3fe7e7b3c843839a01968778f10077d3b310beb0b767b5fd8f447ba509a4d884e31d5ec127c067b9d69715a673065a2adb619e7f56f65459f2ae
Score

3^/10
behavioral7 behavioral8
- Target
  
  resources/app/node_modules/brace-expansion/LICENSE
- Size
  
  1KB
- MD5
  
  a5df515ef062cc3affd8c0ae59c059ec
- SHA1
  
  433c2b9c71bad0957f4831068c2f5d973cef98a9
- SHA256
  
  68f12f6e2c33688699249c01d8f9623c534da20aa71989c57b061b7bc1676d14
- SHA512
  
  0b0068b8beb6864dbb6971d9fe165d2d5fd420bcd6d7bbbd8f42589eb981bf95d854df2d16c21d378ea6d48f562345d2f66de0fd17134dffa8495eb496e6dff0
Score

1^/10
behavioral10 behavioral9
- Target
  
  resources/app/node_modules/brace-expansion/package.json
- Size
  
  963B
- MD5
  
  bbac4f0013e515322e1d83d7590ca275
- SHA1
  
  24b31712f2dbed3bc0e2e8b8f9e13399ba5f000b
- SHA256
  
  9620d66f383fc482264c487bc021d98e453980cc50b320da86375707f69d48ab
- SHA512
  
  300d57e18d33c6e619597aba0cc30c892c4e38b8507a36fddfeb74765a8b0c938cc53ad59228ee2a3a7cd10aa0e4e13175397595b5ea871e0f15bf560f1252bb
Score

3^/10
behavioral11 behavioral12
- Target
  
  resources/app/node_modules/chalk/license
- Size
  
  1KB
- MD5
  
  915042b5df33c31a6db2b37eadaa00e3
- SHA1
  
  5aaf48196ddd4d007a3067aa7f30303ca8e4b29c
- SHA256
  
  48da2f39e100d4085767e94966b43f4fa95ff6a0698fba57ed460914e35f94a0
- SHA512
  
  9c8b2def76ae5ffe4d636166bf9635d7abd69cdac4bf819a2145f7969646d39ae95c96364bc117f9fa544b98518c294233455d4f665af430c75d70798dd4ab13
Score

1^/10
behavioral13 behavioral14
- Target
  
  resources/app/node_modules/chalk/node_modules/has-flag/license
- Size
  
  1KB
- MD5
  
  915042b5df33c31a6db2b37eadaa00e3
- SHA1
  
  5aaf48196ddd4d007a3067aa7f30303ca8e4b29c
- SHA256
  
  48da2f39e100d4085767e94966b43f4fa95ff6a0698fba57ed460914e35f94a0
- SHA512
  
  9c8b2def76ae5ffe4d636166bf9635d7abd69cdac4bf819a2145f7969646d39ae95c96364bc117f9fa544b98518c294233455d4f665af430c75d70798dd4ab13
Score

1^/10
behavioral15 behavioral16
- Target
  
  resources/app/node_modules/chalk/node_modules/has-flag/package.json
- Size
  
  457B
- MD5
  
  b8775a9a70bd4e7bfcfd40c4004331a7
- SHA1
  
  7f821eb955adcd3f50d34fa5c2ecb8d29a5af554
- SHA256
  
  b72f29e906482722a0487d94cda6777a689a8f5c8c0a4969a9faa9961ef59082
- SHA512
  
  6f6f99fc9cf6509dcf57781e1dbc0f30b7533f8ce69c7edca5831abd036b620066f2f5a32ab040ea2c2676a30fbaf5725074ada030e74e410b62c46dec138eab
Score

3^/10
behavioral17 behavioral18
- Target
  
  resources/app/node_modules/chalk/node_modules/supports-color/license
- Size
  
  1KB
- MD5
  
  915042b5df33c31a6db2b37eadaa00e3
- SHA1
  
  5aaf48196ddd4d007a3067aa7f30303ca8e4b29c
- SHA256
  
  48da2f39e100d4085767e94966b43f4fa95ff6a0698fba57ed460914e35f94a0
- SHA512
  
  9c8b2def76ae5ffe4d636166bf9635d7abd69cdac4bf819a2145f7969646d39ae95c96364bc117f9fa544b98518c294233455d4f665af430c75d70798dd4ab13
Score

1^/10
behavioral19 behavioral20
- Target
  
  resources/app/node_modules/chalk/node_modules/supports-color/package.json
- Size
  
  555B
- MD5
  
  3310a203ef7286b8a59c5df1b700cc5c
- SHA1
  
  76e8a3f6d5710dd826d6302bee53d7c71ca64ca2
- SHA256
  
  282cf16f356a2d05e80ee1a27e7647c2154ce89eee3cbc082060f91ec8a38e25
- SHA512
  
  f668695e4e6e94b7324f7c52c771c6cb926500de472ef87fd1a5a46df87d1ce84a4b1ab123c2782a3b43aa14f66efce32c6b93e1c20393d70a499b8ec4af0878
Score

3^/10
behavioral21 behavioral22
- Target
  
  resources/app/node_modules/chalk/package.json
- Size
  
  645B
- MD5
  
  bfacdfd306e90cede7c1db16bda62d42
- SHA1
  
  4d5c54f49d2a246560c6a924b39a3ad99fd88f23
- SHA256
  
  43f20401c253e9742afdc9559a1bd0b60cc6c7d54695f5e7bed23754cf28ee3f
- SHA512
  
  e72029985299b9f5cf6360bdbbf008d6b179d14c04ea5d425d10b2b33d799096530719f3bbe1a0b0a61b7845cd36e968efc9f5914d89451a705f43c468e463d7
Score

3^/10
behavioral23 behavioral24
- Target
  
  resources/app/node_modules/child_process/package.json
- Size
  
  295B
- MD5
  
  c913f6d16eb753431d36ea482cacb065
- SHA1
  
  5cb1c8bdc60101846714e942758d888a008120e4
- SHA256
  
  104f06b6ce2e379c3bb02cdfc1918edd3ee45e1fb3c8b5c4dcd0ab122675a964
- SHA512
  
  ebbc2aa93b22df1e8cec1889022c9f7e54cf5dbdbe6568ae39c3cd355aaab154b9b8197238682dc36143fe5fe2d25f936adb21f5101dcb5aa6570eaa8ec35ade
Score

3^/10
behavioral25 behavioral26
- Target
  
  resources/app/node_modules/color-convert/LICENSE
- Size
  
  1KB
- MD5
  
  9bdadfc9fbb3ab8d5a6d591bdbd52811
- SHA1
  
  2cb896d3773acc17b0f87dbb47759dfde011841b
- SHA256
  
  693866fc419c6f61c8570438ec00659d156ec2b4d4a4d04091711f5f11a365d4
- SHA512
  
  449fbdf7888a5b9088b5f84aa6d1a42cf951782a062079f63fe5e1e797e709ed4737c3e19300d0a98a01013431e73652c5b81438913ba952ff1fb63bce460e5b
Score

1^/10
behavioral27 behavioral28
- Target
  
  resources/app/node_modules/color-convert/package.json
- Size
  
  451B
- MD5
  
  8eeea2a6b7ba5169c33b486cad10ec3b
- SHA1
  
  0e7b68e149e158306402e46aa17a06699ac79c33
- SHA256
  
  5a56bf5ce5ddd347644a5e7804435e583742717221d1c7024c75de766214c8f7
- SHA512
  
  9c505db029e4466ed62e5e69d70a7d6bb538aaeb8289c7642373e9c33af5f46cbedb6c3125ab28bb46b5ea89b56aedc6ba6b824db1eddad5f830a66d56d64efc
Score

3^/10
behavioral29 behavioral30
- Target
  
  resources/app/node_modules/color-name/LICENSE
- Size
  
  1KB
- MD5
  
  d301869b39e08b33665b7c4f16b8e41d
- SHA1
  
  e8bc789b6dc24e4c3fc4d208364dd6b029a81eb1
- SHA256
  
  c064f7a3e353bc1bc977f3c897941c75ef763f44f41677e0a15370ca0853d6e2
- SHA512
  
  fc1d65352c114c7594c9bedf5be432ba39d426feaf50bf8f7c52d32781323c84bfc9a68531aefb558c97ebe46e712e1d35d860ba1e1a6ab48b4a79b894092540
Score

1^/10
behavioral31 behavioral32

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Checks computer location settings

Executes dropped EXE

Loads dropped DLL

Drops file in System32 directory

MITRE ATT&CK Enterprise v15

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32