zloader | a1941786149857faebfd4f2731022d8af6aaa984b981bffd40bd123472b0beb4

Sharing

Copy URL

Twitter E-mail

General

Target

777dae8f41c5c9ba97b798fcd52612de.bin
Size

183.1MB
Sample

240703-c25avaxdnj
MD5

777dae8f41c5c9ba97b798fcd52612de
SHA1

03ec3ee7b1e1a47dc8b0e7f5f980ebd7071c469b
SHA256

a1941786149857faebfd4f2731022d8af6aaa984b981bffd40bd123472b0beb4
SHA512

792ccba986338f3a3d5475d615fa276a73c52eb483484ee2fda16a143f1100afdfd0dea2bb309bfba54202e07707df7bb025677f6477bf44ddb8f2282093f592
SSDEEP

3145728:qJcuNt6i+X0MdTUPo+YFawtU4odz5zA436E7IkGl0BkChNw5+VTmms+B6Q8k:ScuN7+QYFjmPz5zAJ0wahNw5+VTTs+Bl

Score

10^/10

zloader execution

Malware Config

Targets

- Target
  
  777dae8f41c5c9ba97b798fcd52612de.bin
- Size
  
  183.1MB
- MD5
  
  777dae8f41c5c9ba97b798fcd52612de
- SHA1
  
  03ec3ee7b1e1a47dc8b0e7f5f980ebd7071c469b
- SHA256
  
  a1941786149857faebfd4f2731022d8af6aaa984b981bffd40bd123472b0beb4
- SHA512
  
  792ccba986338f3a3d5475d615fa276a73c52eb483484ee2fda16a143f1100afdfd0dea2bb309bfba54202e07707df7bb025677f6477bf44ddb8f2282093f592
- SSDEEP
  
  3145728:qJcuNt6i+X0MdTUPo+YFawtU4odz5zA436E7IkGl0BkChNw5+VTmms+B6Q8k:ScuN7+QYFjmPz5zAJ0wahNw5+VTTs+Bl
Score

7^/10
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
behavioral1 behavioral2
- Target
  
  $PLUGINSDIR/BgImage.dll
- Size
  
  7KB
- MD5
  
  487368e6fce9ab9c5ea053af0990c5ef
- SHA1
  
  b538e37c87d4b9a7645dcbbd9e93025a31849702
- SHA256
  
  e27efa5dfde875bd6b826fafb4c7698db6b6e30e68715a1c03eb018e3170fc04
- SHA512
  
  bb3ed4c0d17a11365b72653112b48c8c63ab10590dda3dfd90aa453f0d64203000e4571c73998063352240e1671d14da5ee394439899aaa31054fa2e9b722ea7
- SSDEEP
  
  96:8efk1LFJaO1/radJEaYtv1Zs4lkL8y3A2EN8Cmy3uT24j7J3kWyy/:tcTJa2roqJyA2EN8diuTHje
Score

1^/10
behavioral3 behavioral4
- Target
  
  $PLUGINSDIR/System.dll
- Size
  
  12KB
- MD5
  
  0d7ad4f45dc6f5aa87f606d0331c6901
- SHA1
  
  48df0911f0484cbe2a8cdd5362140b63c41ee457
- SHA256
  
  3eb38ae99653a7dbc724132ee240f6e5c4af4bfe7c01d31d23faf373f9f2eaca
- SHA512
  
  c07de7308cb54205e8bd703001a7fe4fd7796c9ac1b4bb330c77c872bf712b093645f40b80ce7127531fe6746a5b66e18ea073ab6a644934abed9bb64126fea9
- SSDEEP
  
  192:1enY0LWelt70elWjvfstJcVtwtYbjnIOg5AaDnbC7ypXhtIj:18PJlt70esj0Mt9vn6ay6
Score

3^/10
behavioral5 behavioral6
- Target
  
  Battly Launcher.exe
- Size
  
  145.0MB
- MD5
  
  bc7c6b1b9fc1a26ba1012d7ae7a1e19d
- SHA1
  
  32ff73e76480c3dac792e7a68693daddd53ea427
- SHA256
  
  942c56743233b7dfd9cf1ff42e9a5aa3ca3633b95465ce3b7ff07c9f52ab0375
- SHA512
  
  f0dfd2dcf5f4162250f1b70e76734857a4b96751f95aff9b181d8437cdf2ba7cb88f1af2291581ed1c29193c578e032420f198564788b6eb9958c99bf4948edc
- SSDEEP
  
  1572864:SQqT4eFUirK1e2zSQ5Rcw/N5cae/bHhrPdacyodvcPSBoHESUlyS:kBKRcAMyS
Score

1^/10
behavioral7 behavioral8
- Target
  
  LICENSES.chromium.html
- Size
  
  8.7MB
- MD5
  
  bd0ced1bc275f592b03bafac4b301a93
- SHA1
  
  68776b7d9139588c71fbc51fe15243c9835acb67
- SHA256
  
  ad35e72893910d6f6ed20f4916457417af05b94ab5204c435c35f66a058d156b
- SHA512
  
  5052ae32dae0705cc29ea170bcc5210b48e4af91d4ecec380cb4a57ce1c56bc1d834fc2d96e2a0f5f640fcac8cafe4a4fdd0542f26ca430d76aa8b9212ba77aa
- SSDEEP
  
  24576:KPQQ/6MP6P5d1n+wRcXe1Lmfpm6k626D6b6+eGnkywBIpv:Cy8OeG8k
Score

1^/10
behavioral10 behavioral9
- Target
  
  d3dcompiler_47.dll
- Size
  
  4.7MB
- MD5
  
  2191e768cc2e19009dad20dc999135a3
- SHA1
  
  f49a46ba0e954e657aaed1c9019a53d194272b6a
- SHA256
  
  7353f25dc5cf84d09894e3e0461cef0e56799adbc617fce37620ca67240b547d
- SHA512
  
  5adcb00162f284c16ec78016d301fc11559dd0a781ffbeff822db22efbed168b11d7e5586ea82388e9503b0c7d3740cf2a08e243877f5319202491c8a641c970
- SSDEEP
  
  49152:KCZnRO4XyM53Rkq4ypQqdoRpmruVNYvkaRwvhiD0N+YEzI4og/RfzHLeHTRhFRNc:xG2QCwmHPnog/pzHAo/A6l
Score

1^/10
behavioral11
- Target
  
  ffmpeg.dll
- Size
  
  2.7MB
- MD5
  
  bf09deeeb497aeddaf6194e695776b8b
- SHA1
  
  e7d8719d6d0664b8746581b88eb03a486f588844
- SHA256
  
  450d5e6a11dc31dc6e1a7af472cd08b7e7a78976b1f0aa1c62055a0a720f5080
- SHA512
  
  38d3cac922634df85ddfd8d070b38cf4973bba8f37d3246453377f30165cc4377b4e67c4e0bca0ffe3c3fa0e024b23a31ec009e16d0ab3042593b5a6e164669f
- SSDEEP
  
  49152:2gUBJTIe17EwJvr3OXtgTyFBcCen6yfUvUUP/bkLmV:ZY1vreXOuFePUP/bay
Score

1^/10
behavioral12 behavioral13
- Target
  
  libEGL.dll
- Size
  
  467KB
- MD5
  
  3a5cbf0ce848ec30a2f8fe1760564515
- SHA1
  
  31bf9312cd1beaedaa91766e5cde13406d6ea219
- SHA256
  
  afef052c621f72ba986d917a9e090d23a13f4ab6bc09f158eeb73fd671b94219
- SHA512
  
  bd5713e1d22145b4cc52f4e46b464f443aad6f783a5793268e7d9dca969f27b70e706eecd54cb01be1c94256e6a95864c6b7e50027cef7fa870cdb16820ad602
- SSDEEP
  
  6144:FaEXc0Izd+rYvqNUMbh9L8OgKcG4BEFATaxlI/:/dIZ+rwqNUMbFL2BE6W8/
Score

1^/10
behavioral14 behavioral15
- Target
  
  libGLESv2.dll
- Size
  
  7.3MB
- MD5
  
  c783045e4b7f00c847678d43a77367f7
- SHA1
  
  7f9192ce0b23ac93561aeec9d9c38daa3136c146
- SHA256
  
  3a39137dcee6cb6663ae9cca424b6b05cf56c0ad7e32fb72cb94549ea9dbcae8
- SHA512
  
  64e6d4fc84f1217ceef05a22ad63a6618ffdc470b1faf4ad9e2d7bab59e9285527b9c5fd7ea4be673a08b9466434e3c098e839bf6955597e3d8aa0e80589f4a3
- SSDEEP
  
  98304:A99bSJY8juRSvODN1uVZ5U7NJhbXm3fP:Aeu8iEOx73hzCfP
Score

1^/10
behavioral16 behavioral17
- Target
  
  resources/app/node_modules/adm-zip/adm-zip.js
- Size
  
  30KB
- MD5
  
  9b6da3cd4a4ce0963e80d0e6dc1a11f1
- SHA1
  
  fce6550c2231f60425661f2f7db99efff491cdff
- SHA256
  
  cb49867d6ffe8e7c08ad0e6466c86450b0f81910069ed1ad9d5b7b9c27367929
- SHA512
  
  38f325ced4315f7fd39f9ec885e1a35f8d5c49bfe9721c3ae0b54d040c76e7df3e6d557f76bb5783594b0fe5c15f9e73f8c7a21fee373ecbd97ed9220d3127ba
- SSDEEP
  
  384:T4XzvHf944AOOLlPHWuFz5AjHxLPVzVbAB1kfVeHW3W5SqdCLFWYi82et/2Ktvbe:UzvF4DPHzFn11IqdCpoFaU
Score

3^/10

execution
behavioral18 behavioral19
- Target
  
  resources/app/node_modules/adm-zip/headers/entryHeader.js
- Size
  
  11KB
- MD5
  
  db0294dd88cf4922e3cbb5e45d087287
- SHA1
  
  f46ea2a1a7e9cb0c6c25fc436743b78d95da1841
- SHA256
  
  d3ca0adfd642be6287daf5a7cc8d3959332f31ba52b6ef1a53e4520bf4175f3f
- SHA512
  
  2f77a248db215a4d7287dfe7227adc1bbd4239d31731a743994dd4a4e4f0aa061dacb3fc9d79f22364d3771ac3b36d41dca5788b34892c94f8cb8d2d95a6b661
- SSDEEP
  
  192:ybVz3fxOy27Ad1mMcyfPrzq638jfhDq5YoYfXSlAHhDQf:y5fxOv7VMcyfPXqm8jfhD+
Score

3^/10

execution
behavioral20 behavioral21
- Target
  
  resources/app/node_modules/adm-zip/headers/index.js
- Size
  
  94B
- MD5
  
  64bc889b89f1c8a04a698a8f74e24e5b
- SHA1
  
  68781da04cf1ebc4f03434ea5b2b65f10cca07e6
- SHA256
  
  536e4b5bf009a3d9f6eccfbbc4157cb6de663d889e0826ea5f6e5fa17aaeb8bf
- SHA512
  
  9eb207fa61862aebd9cc5a89f85757313c7f163ea0f5a15c16250f79845b9caa1d8109bc3e634a9ed3fb0616c71aed3005ace48eff0941518c778c3063613975
Score

3^/10

execution
behavioral22 behavioral23
- Target
  
  resources/app/node_modules/adm-zip/headers/mainHeader.js
- Size
  
  4KB
- MD5
  
  1d35f59aece6922da87e6183e7f8379b
- SHA1
  
  b772c6b2285d6f7c099bfd7ace005e730bd12c78
- SHA256
  
  3269b558fd8990df8ae1f500268e0512854c04bffefcaa0e584360de1809b84a
- SHA512
  
  3cb59c8fb586a89936ad4fbd4d29c54cfe8e0ae9abcc4ff70ef03a3cdbefff9b4a5d91658da79e6746ab01af9cfc57dd908b8e478ee4aee5848e0252a1f68603
- SSDEEP
  
  96:riWDe6p2ciGztwfWH7gNJzaI2mhUJfPok1:rFDe6pPyEp1
Score

3^/10

execution
behavioral24 behavioral25
- Target
  
  resources/app/node_modules/adm-zip/methods/deflater.js
- Size
  
  1021B
- MD5
  
  41fd6791497f7d74ee56a7753e08da66
- SHA1
  
  bd62d07bfe703da89172fcfeaa8848d6ba5c68b4
- SHA256
  
  6dc41b2460594cfa5136b797653c166b2f7403820a40f2fca17cca35a5de1b5f
- SHA512
  
  5f16aeb477321470986a8c9807ebf3b75e979e5fb34156028ef56f44f38c4f4d72d9d086784e9dfedeffa61f91f973b6ac7e7ba1730eebd86bb549de2dbb4761
Score

3^/10

execution
behavioral26 behavioral27
- Target
  
  resources/app/node_modules/adm-zip/methods/index.js
- Size
  
  128B
- MD5
  
  74d54dda1e050cad9b31da325f92fb01
- SHA1
  
  683b0412f3bdb3ae54cd809e37f456dade4d046a
- SHA256
  
  d67714f1a04be942f90be77069af3ff4214aa8ee84b26edeff3a87eb0d8e2dc0
- SHA512
  
  88ff974e69207c427ce1c9161489a275c4328ba392da65b268614fd5c66ef9feb10dafe1464dcc5873221de61bdb045dcf47092760c973ec06825158978df3e6
Score

3^/10

execution
behavioral28 behavioral29
- Target
  
  resources/app/node_modules/adm-zip/methods/inflater.js
- Size
  
  936B
- MD5
  
  ddf58fccf9d270a32d6fe17fe86a26f9
- SHA1
  
  c720d51c923aa71bce2a27a3d081af09de0e2a67
- SHA256
  
  ac2c664bd94fe9daee76174aa00d149d60bbbe6ae5d5865b14bd76e9b7d2d612
- SHA512
  
  bc5914af2950f7e87b0071d54f885b7ef494cee1f036e9fe2e31365506ab78a6327dd25d2c565c09b0ecd465ddc79bb8fc5ff7b6c3a9b15a4d4f044fe816d610
Score

3^/10

execution
behavioral30 behavioral31
- Target
  
  resources/app/node_modules/adm-zip/methods/zipcrypto.js
- Size
  
  5KB
- MD5
  
  84d22177957b42a5f8cef39e729bcaef
- SHA1
  
  6a6dea4aab4c6c8b1b4b19a246f01b03cb114711
- SHA256
  
  2b76c14cac47da833e1bdf690faf68acc0f5ceb645605df876f42e67801d2f1c
- SHA512
  
  a94de7eb1aac18bba8854041a8d9a2f035dacc338e007462d891c6557f68c7a6d179d82078f0bddc047e29766f961e7c83c5a278a08e8b3b72917f61625320e0
- SSDEEP
  
  96:kRFxIiQ1K80cAAbZPxijV/7jRcDG2+2Ihpq68rMyA+GBBEF/yJ/rshl2kJGWvLoC:kOiQ1fUAbZ0jxdz2+thJ8FoDJ/g+K1EC
Score

3^/10

execution
behavioral32

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

JavaScript

T1059.007

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Checks computer location settings

Executes dropped EXE

Loads dropped DLL

Drops file in System32 directory

MITRE ATT&CK Enterprise v15

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32