zloader | a1941786149857faebfd4f2731022d8af6aaa984b981bffd40bd123472b0beb4

Sharing

Copy URL Twitter E-mail

General

Target
777dae8f41c5c9ba97b798fcd52612de.bin
Size 183.1MB
Sample240703-c25avaxdnj
SHA256 a1941786149857faebfd4f2731022d8af6aaa984b981bffd40bd123472b0beb4
MD5 777dae8f41c5c9ba97b798fcd52612de
SHA1 03ec3ee7b1e1a47dc8b0e7f5f980ebd7071c469b
SHA512 792ccba986338f3a3d5475d615fa276a73c52eb483484ee2fda16a143f1100afdfd0dea2bb309bfba54202e07707df7bb025677f6477bf44ddb8f2282093f592
SSDEEP 3145728:qJcuNt6i+X0MdTUPo+YFawtU4odz5zA436E7IkGl0BkChNw5+VTmms+B6Q8k:ScuN7+QYFjmPz5zAJ0wahNw5+VTTs+Bl
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

zloader execution

Malware Config

Targets

- Target
  777dae8f41c5c9ba97b798fcd52612de.bin
- Size 183.1MB
- SHA256 a1941786149857faebfd4f2731022d8af6aaa984b981bffd40bd123472b0beb4
- MD5 777dae8f41c5c9ba97b798fcd52612de
- SHA1 03ec3ee7b1e1a47dc8b0e7f5f980ebd7071c469b
- SHA512 792ccba986338f3a3d5475d615fa276a73c52eb483484ee2fda16a143f1100afdfd0dea2bb309bfba54202e07707df7bb025677f6477bf44ddb8f2282093f592
- SSDEEP 3145728:qJcuNt6i+X0MdTUPo+YFawtU4odz5zA436E7IkGl0BkChNw5+VTmms+B6Q8k:ScuN7+QYFjmPz5zAJ0wahNw5+VTTs+Bl
- MD5 SHA1 SHA512 SSDEEP
Score

7^/10
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
behavioral1 behavioral2
- Target
  $PLUGINSDIR/BgImage.dll
- Size 7KB
- SHA256 e27efa5dfde875bd6b826fafb4c7698db6b6e30e68715a1c03eb018e3170fc04
- MD5 487368e6fce9ab9c5ea053af0990c5ef
- SHA1 b538e37c87d4b9a7645dcbbd9e93025a31849702
- SHA512 bb3ed4c0d17a11365b72653112b48c8c63ab10590dda3dfd90aa453f0d64203000e4571c73998063352240e1671d14da5ee394439899aaa31054fa2e9b722ea7
- SSDEEP 96:8efk1LFJaO1/radJEaYtv1Zs4lkL8y3A2EN8Cmy3uT24j7J3kWyy/:tcTJa2roqJyA2EN8diuTHje
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral3 behavioral4
- Target
  $PLUGINSDIR/System.dll
- Size 12KB
- SHA256 3eb38ae99653a7dbc724132ee240f6e5c4af4bfe7c01d31d23faf373f9f2eaca
- MD5 0d7ad4f45dc6f5aa87f606d0331c6901
- SHA1 48df0911f0484cbe2a8cdd5362140b63c41ee457
- SHA512 c07de7308cb54205e8bd703001a7fe4fd7796c9ac1b4bb330c77c872bf712b093645f40b80ce7127531fe6746a5b66e18ea073ab6a644934abed9bb64126fea9
- SSDEEP 192:1enY0LWelt70elWjvfstJcVtwtYbjnIOg5AaDnbC7ypXhtIj:18PJlt70esj0Mt9vn6ay6
- MD5 SHA1 SHA512 SSDEEP
Score

3^/10
behavioral5 behavioral6
- Target
  Battly Launcher.exe
- Size 145.0MB
- SHA256 942c56743233b7dfd9cf1ff42e9a5aa3ca3633b95465ce3b7ff07c9f52ab0375
- MD5 bc7c6b1b9fc1a26ba1012d7ae7a1e19d
- SHA1 32ff73e76480c3dac792e7a68693daddd53ea427
- SHA512 f0dfd2dcf5f4162250f1b70e76734857a4b96751f95aff9b181d8437cdf2ba7cb88f1af2291581ed1c29193c578e032420f198564788b6eb9958c99bf4948edc
- SSDEEP 1572864:SQqT4eFUirK1e2zSQ5Rcw/N5cae/bHhrPdacyodvcPSBoHESUlyS:kBKRcAMyS
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral7 behavioral8
- Target
  LICENSES.chromium.html
- Size 8.7MB
- SHA256 ad35e72893910d6f6ed20f4916457417af05b94ab5204c435c35f66a058d156b
- MD5 bd0ced1bc275f592b03bafac4b301a93
- SHA1 68776b7d9139588c71fbc51fe15243c9835acb67
- SHA512 5052ae32dae0705cc29ea170bcc5210b48e4af91d4ecec380cb4a57ce1c56bc1d834fc2d96e2a0f5f640fcac8cafe4a4fdd0542f26ca430d76aa8b9212ba77aa
- SSDEEP 24576:KPQQ/6MP6P5d1n+wRcXe1Lmfpm6k626D6b6+eGnkywBIpv:Cy8OeG8k
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral10 behavioral9
- Target
  d3dcompiler_47.dll
- Size 4.7MB
- SHA256 7353f25dc5cf84d09894e3e0461cef0e56799adbc617fce37620ca67240b547d
- MD5 2191e768cc2e19009dad20dc999135a3
- SHA1 f49a46ba0e954e657aaed1c9019a53d194272b6a
- SHA512 5adcb00162f284c16ec78016d301fc11559dd0a781ffbeff822db22efbed168b11d7e5586ea82388e9503b0c7d3740cf2a08e243877f5319202491c8a641c970
- SSDEEP 49152:KCZnRO4XyM53Rkq4ypQqdoRpmruVNYvkaRwvhiD0N+YEzI4og/RfzHLeHTRhFRNc:xG2QCwmHPnog/pzHAo/A6l
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral11
- Target
  ffmpeg.dll
- Size 2.7MB
- SHA256 450d5e6a11dc31dc6e1a7af472cd08b7e7a78976b1f0aa1c62055a0a720f5080
- MD5 bf09deeeb497aeddaf6194e695776b8b
- SHA1 e7d8719d6d0664b8746581b88eb03a486f588844
- SHA512 38d3cac922634df85ddfd8d070b38cf4973bba8f37d3246453377f30165cc4377b4e67c4e0bca0ffe3c3fa0e024b23a31ec009e16d0ab3042593b5a6e164669f
- SSDEEP 49152:2gUBJTIe17EwJvr3OXtgTyFBcCen6yfUvUUP/bkLmV:ZY1vreXOuFePUP/bay
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral12 behavioral13
- Target
  libEGL.dll
- Size 467KB
- SHA256 afef052c621f72ba986d917a9e090d23a13f4ab6bc09f158eeb73fd671b94219
- MD5 3a5cbf0ce848ec30a2f8fe1760564515
- SHA1 31bf9312cd1beaedaa91766e5cde13406d6ea219
- SHA512 bd5713e1d22145b4cc52f4e46b464f443aad6f783a5793268e7d9dca969f27b70e706eecd54cb01be1c94256e6a95864c6b7e50027cef7fa870cdb16820ad602
- SSDEEP 6144:FaEXc0Izd+rYvqNUMbh9L8OgKcG4BEFATaxlI/:/dIZ+rwqNUMbFL2BE6W8/
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral14 behavioral15
- Target
  libGLESv2.dll
- Size 7.3MB
- SHA256 3a39137dcee6cb6663ae9cca424b6b05cf56c0ad7e32fb72cb94549ea9dbcae8
- MD5 c783045e4b7f00c847678d43a77367f7
- SHA1 7f9192ce0b23ac93561aeec9d9c38daa3136c146
- SHA512 64e6d4fc84f1217ceef05a22ad63a6618ffdc470b1faf4ad9e2d7bab59e9285527b9c5fd7ea4be673a08b9466434e3c098e839bf6955597e3d8aa0e80589f4a3
- SSDEEP 98304:A99bSJY8juRSvODN1uVZ5U7NJhbXm3fP:Aeu8iEOx73hzCfP
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral16 behavioral17
- Target
  resources/app/node_modules/adm-zip/adm-zip.js
- Size 30KB
- SHA256 cb49867d6ffe8e7c08ad0e6466c86450b0f81910069ed1ad9d5b7b9c27367929
- MD5 9b6da3cd4a4ce0963e80d0e6dc1a11f1
- SHA1 fce6550c2231f60425661f2f7db99efff491cdff
- SHA512 38f325ced4315f7fd39f9ec885e1a35f8d5c49bfe9721c3ae0b54d040c76e7df3e6d557f76bb5783594b0fe5c15f9e73f8c7a21fee373ecbd97ed9220d3127ba
- SSDEEP 384:T4XzvHf944AOOLlPHWuFz5AjHxLPVzVbAB1kfVeHW3W5SqdCLFWYi82et/2Ktvbe:UzvF4DPHzFn11IqdCpoFaU
- MD5 SHA1 SHA512 SSDEEP
Score

3^/10

execution
behavioral18 behavioral19
- Target
  resources/app/node_modules/adm-zip/headers/entryHeader.js
- Size 11KB
- SHA256 d3ca0adfd642be6287daf5a7cc8d3959332f31ba52b6ef1a53e4520bf4175f3f
- MD5 db0294dd88cf4922e3cbb5e45d087287
- SHA1 f46ea2a1a7e9cb0c6c25fc436743b78d95da1841
- SHA512 2f77a248db215a4d7287dfe7227adc1bbd4239d31731a743994dd4a4e4f0aa061dacb3fc9d79f22364d3771ac3b36d41dca5788b34892c94f8cb8d2d95a6b661
- SSDEEP 192:ybVz3fxOy27Ad1mMcyfPrzq638jfhDq5YoYfXSlAHhDQf:y5fxOv7VMcyfPXqm8jfhD+
- MD5 SHA1 SHA512 SSDEEP
Score

3^/10

execution
behavioral20 behavioral21
- Target
  resources/app/node_modules/adm-zip/headers/index.js
- Size 94B
- SHA256 536e4b5bf009a3d9f6eccfbbc4157cb6de663d889e0826ea5f6e5fa17aaeb8bf
- MD5 64bc889b89f1c8a04a698a8f74e24e5b
- SHA1 68781da04cf1ebc4f03434ea5b2b65f10cca07e6
- SHA512 9eb207fa61862aebd9cc5a89f85757313c7f163ea0f5a15c16250f79845b9caa1d8109bc3e634a9ed3fb0616c71aed3005ace48eff0941518c778c3063613975
- MD5 SHA1 SHA512
Score

3^/10

execution
behavioral22 behavioral23
- Target
  resources/app/node_modules/adm-zip/headers/mainHeader.js
- Size 4KB
- SHA256 3269b558fd8990df8ae1f500268e0512854c04bffefcaa0e584360de1809b84a
- MD5 1d35f59aece6922da87e6183e7f8379b
- SHA1 b772c6b2285d6f7c099bfd7ace005e730bd12c78
- SHA512 3cb59c8fb586a89936ad4fbd4d29c54cfe8e0ae9abcc4ff70ef03a3cdbefff9b4a5d91658da79e6746ab01af9cfc57dd908b8e478ee4aee5848e0252a1f68603
- SSDEEP 96:riWDe6p2ciGztwfWH7gNJzaI2mhUJfPok1:rFDe6pPyEp1
- MD5 SHA1 SHA512 SSDEEP
Score

3^/10

execution
behavioral24 behavioral25
- Target
  resources/app/node_modules/adm-zip/methods/deflater.js
- Size 1021B
- SHA256 6dc41b2460594cfa5136b797653c166b2f7403820a40f2fca17cca35a5de1b5f
- MD5 41fd6791497f7d74ee56a7753e08da66
- SHA1 bd62d07bfe703da89172fcfeaa8848d6ba5c68b4
- SHA512 5f16aeb477321470986a8c9807ebf3b75e979e5fb34156028ef56f44f38c4f4d72d9d086784e9dfedeffa61f91f973b6ac7e7ba1730eebd86bb549de2dbb4761
- MD5 SHA1 SHA512
Score

3^/10

execution
behavioral26 behavioral27
- Target
  resources/app/node_modules/adm-zip/methods/index.js
- Size 128B
- SHA256 d67714f1a04be942f90be77069af3ff4214aa8ee84b26edeff3a87eb0d8e2dc0
- MD5 74d54dda1e050cad9b31da325f92fb01
- SHA1 683b0412f3bdb3ae54cd809e37f456dade4d046a
- SHA512 88ff974e69207c427ce1c9161489a275c4328ba392da65b268614fd5c66ef9feb10dafe1464dcc5873221de61bdb045dcf47092760c973ec06825158978df3e6
- MD5 SHA1 SHA512
Score

3^/10

execution
behavioral28 behavioral29
- Target
  resources/app/node_modules/adm-zip/methods/inflater.js
- Size 936B
- SHA256 ac2c664bd94fe9daee76174aa00d149d60bbbe6ae5d5865b14bd76e9b7d2d612
- MD5 ddf58fccf9d270a32d6fe17fe86a26f9
- SHA1 c720d51c923aa71bce2a27a3d081af09de0e2a67
- SHA512 bc5914af2950f7e87b0071d54f885b7ef494cee1f036e9fe2e31365506ab78a6327dd25d2c565c09b0ecd465ddc79bb8fc5ff7b6c3a9b15a4d4f044fe816d610
- MD5 SHA1 SHA512
Score

3^/10

execution
behavioral30 behavioral31
- Target
  resources/app/node_modules/adm-zip/methods/zipcrypto.js
- Size 5KB
- SHA256 2b76c14cac47da833e1bdf690faf68acc0f5ceb645605df876f42e67801d2f1c
- MD5 84d22177957b42a5f8cef39e729bcaef
- SHA1 6a6dea4aab4c6c8b1b4b19a246f01b03cb114711
- SHA512 a94de7eb1aac18bba8854041a8d9a2f035dacc338e007462d891c6557f68c7a6d179d82078f0bddc047e29766f961e7c83c5a278a08e8b3b72917f61625320e0
- SSDEEP 96:kRFxIiQ1K80cAAbZPxijV/7jRcDG2+2Ihpq68rMyA+GBBEF/yJ/rshl2kJGWvLoC:kOiQ1fUAbZ0jxdz2+thJ8FoDJ/g+K1EC
- MD5 SHA1 SHA512 SSDEEP
Score

3^/10

execution
behavioral32

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

JavaScript

T1059.007

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Checks computer location settings

Executes dropped EXE

Loads dropped DLL

Drops file in System32 directory

MITRE ATT&CK Enterprise v15

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32