zloader | a1941786149857faebfd4f2731022d8af6aaa984b981bffd40bd123472b0beb4 | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
Battly-Launcher-Windows.exe
Size 183.1MB
Sample240721-1cdctswajd
SHA256 a1941786149857faebfd4f2731022d8af6aaa984b981bffd40bd123472b0beb4
MD5 777dae8f41c5c9ba97b798fcd52612de
SHA1 03ec3ee7b1e1a47dc8b0e7f5f980ebd7071c469b
SHA512 792ccba986338f3a3d5475d615fa276a73c52eb483484ee2fda16a143f1100afdfd0dea2bb309bfba54202e07707df7bb025677f6477bf44ddb8f2282093f592
SSDEEP 3145728:qJcuNt6i+X0MdTUPo+YFawtU4odz5zA436E7IkGl0BkChNw5+VTmms+B6Q8k:ScuN7+QYFjmPz5zAJ0wahNw5+VTTs+Bl
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

zloader

Malware Config

Targets

- Target
  Battly-Launcher-Windows.exe
- Size 183.1MB
- SHA256 a1941786149857faebfd4f2731022d8af6aaa984b981bffd40bd123472b0beb4
- MD5 777dae8f41c5c9ba97b798fcd52612de
- SHA1 03ec3ee7b1e1a47dc8b0e7f5f980ebd7071c469b
- SHA512 792ccba986338f3a3d5475d615fa276a73c52eb483484ee2fda16a143f1100afdfd0dea2bb309bfba54202e07707df7bb025677f6477bf44ddb8f2282093f592
- SSDEEP 3145728:qJcuNt6i+X0MdTUPo+YFawtU4odz5zA436E7IkGl0BkChNw5+VTmms+B6Q8k:ScuN7+QYFjmPz5zAJ0wahNw5+VTTs+Bl
- MD5 SHA1 SHA512 SSDEEP
Score

7^/10
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
behavioral1 behavioral2
- Target
  resources/app/node_modules/async/bower.json
- Size 239B
- SHA256 a3e2209912611b3f28ada407deac23712a8c3702ca53b1ee0569a613d4c6f227
- MD5 7c9c6b878a12876e602e07c2fe15231a
- SHA1 ad6e412a24fd1c1a7e7e6b1654e6ae2560f9ec07
- SHA512 099d4e1df45c440bb3e6279843cad0151432e2488d1fe97204d55cf13019e442b0b7d294ec92d0ffab5b7c04ccc5e11ea02cbd54f9347244c455270bf1b6c722
- MD5 SHA1 SHA512
Score

3^/10
behavioral3 behavioral4
- Target
  resources/app/node_modules/balanced-match/LICENSE.md
- Size 1KB
- SHA256 a1bd5deadb6a06dd74efa852c1b8b23f63b67f2214fbe9c8bd591da51da69268
- MD5 7fa99ddc3424107350ca6e9a24552085
- SHA1 09013c002fbdd686da2ec13c5a6d014f0a294ba9
- SHA512 389651cc725f7fa28dfb45e5de84e232212618f4adc187443956c8725e5684f39dd25bf040f95513d17675ed2de7188fa110e669b91987ad956a95c224acc251
- MD5 SHA1 SHA512
Score

3^/10
behavioral5 behavioral6
- Target
  resources/app/node_modules/balanced-match/package.json
- Size 891B
- SHA256 b4cfa3b375d23e8e979227e68db4d4ea1e810328458c78390886f2fd1df5740e
- MD5 0130280bf90eac1705fff7300dbacb2d
- SHA1 6d6b92d1267c374384bac32a0a8d435b762b852a
- SHA512 5dec31f3125b3fe7e7b3c843839a01968778f10077d3b310beb0b767b5fd8f447ba509a4d884e31d5ec127c067b9d69715a673065a2adb619e7f56f65459f2ae
- MD5 SHA1 SHA512
Score

3^/10
behavioral7 behavioral8
- Target
  resources/app/node_modules/brace-expansion/LICENSE
- Size 1KB
- SHA256 68f12f6e2c33688699249c01d8f9623c534da20aa71989c57b061b7bc1676d14
- MD5 a5df515ef062cc3affd8c0ae59c059ec
- SHA1 433c2b9c71bad0957f4831068c2f5d973cef98a9
- SHA512 0b0068b8beb6864dbb6971d9fe165d2d5fd420bcd6d7bbbd8f42589eb981bf95d854df2d16c21d378ea6d48f562345d2f66de0fd17134dffa8495eb496e6dff0
- MD5 SHA1 SHA512
Score

1^/10
behavioral10 behavioral9
- Target
  resources/app/node_modules/brace-expansion/package.json
- Size 963B
- SHA256 9620d66f383fc482264c487bc021d98e453980cc50b320da86375707f69d48ab
- MD5 bbac4f0013e515322e1d83d7590ca275
- SHA1 24b31712f2dbed3bc0e2e8b8f9e13399ba5f000b
- SHA512 300d57e18d33c6e619597aba0cc30c892c4e38b8507a36fddfeb74765a8b0c938cc53ad59228ee2a3a7cd10aa0e4e13175397595b5ea871e0f15bf560f1252bb
- MD5 SHA1 SHA512
Score

3^/10
behavioral11 behavioral12
- Target
  resources/app/node_modules/chalk/license
- Size 1KB
- SHA256 48da2f39e100d4085767e94966b43f4fa95ff6a0698fba57ed460914e35f94a0
- MD5 915042b5df33c31a6db2b37eadaa00e3
- SHA1 5aaf48196ddd4d007a3067aa7f30303ca8e4b29c
- SHA512 9c8b2def76ae5ffe4d636166bf9635d7abd69cdac4bf819a2145f7969646d39ae95c96364bc117f9fa544b98518c294233455d4f665af430c75d70798dd4ab13
- MD5 SHA1 SHA512
Score

1^/10
behavioral13 behavioral14
- Target
  resources/app/node_modules/chalk/node_modules/has-flag/license
- Size 1KB
- SHA256 48da2f39e100d4085767e94966b43f4fa95ff6a0698fba57ed460914e35f94a0
- MD5 915042b5df33c31a6db2b37eadaa00e3
- SHA1 5aaf48196ddd4d007a3067aa7f30303ca8e4b29c
- SHA512 9c8b2def76ae5ffe4d636166bf9635d7abd69cdac4bf819a2145f7969646d39ae95c96364bc117f9fa544b98518c294233455d4f665af430c75d70798dd4ab13
- MD5 SHA1 SHA512
Score

1^/10
behavioral15 behavioral16
- Target
  resources/app/node_modules/chalk/node_modules/has-flag/package.json
- Size 457B
- SHA256 b72f29e906482722a0487d94cda6777a689a8f5c8c0a4969a9faa9961ef59082
- MD5 b8775a9a70bd4e7bfcfd40c4004331a7
- SHA1 7f821eb955adcd3f50d34fa5c2ecb8d29a5af554
- SHA512 6f6f99fc9cf6509dcf57781e1dbc0f30b7533f8ce69c7edca5831abd036b620066f2f5a32ab040ea2c2676a30fbaf5725074ada030e74e410b62c46dec138eab
- MD5 SHA1 SHA512
Score

3^/10
behavioral17 behavioral18
- Target
  resources/app/node_modules/chalk/node_modules/supports-color/license
- Size 1KB
- SHA256 48da2f39e100d4085767e94966b43f4fa95ff6a0698fba57ed460914e35f94a0
- MD5 915042b5df33c31a6db2b37eadaa00e3
- SHA1 5aaf48196ddd4d007a3067aa7f30303ca8e4b29c
- SHA512 9c8b2def76ae5ffe4d636166bf9635d7abd69cdac4bf819a2145f7969646d39ae95c96364bc117f9fa544b98518c294233455d4f665af430c75d70798dd4ab13
- MD5 SHA1 SHA512
Score

1^/10
behavioral19 behavioral20
- Target
  resources/app/node_modules/chalk/node_modules/supports-color/package.json
- Size 555B
- SHA256 282cf16f356a2d05e80ee1a27e7647c2154ce89eee3cbc082060f91ec8a38e25
- MD5 3310a203ef7286b8a59c5df1b700cc5c
- SHA1 76e8a3f6d5710dd826d6302bee53d7c71ca64ca2
- SHA512 f668695e4e6e94b7324f7c52c771c6cb926500de472ef87fd1a5a46df87d1ce84a4b1ab123c2782a3b43aa14f66efce32c6b93e1c20393d70a499b8ec4af0878
- MD5 SHA1 SHA512
Score

3^/10
behavioral21 behavioral22
- Target
  resources/app/node_modules/chalk/package.json
- Size 645B
- SHA256 43f20401c253e9742afdc9559a1bd0b60cc6c7d54695f5e7bed23754cf28ee3f
- MD5 bfacdfd306e90cede7c1db16bda62d42
- SHA1 4d5c54f49d2a246560c6a924b39a3ad99fd88f23
- SHA512 e72029985299b9f5cf6360bdbbf008d6b179d14c04ea5d425d10b2b33d799096530719f3bbe1a0b0a61b7845cd36e968efc9f5914d89451a705f43c468e463d7
- MD5 SHA1 SHA512
Score

3^/10
behavioral23 behavioral24
- Target
  resources/app/node_modules/child_process/package.json
- Size 295B
- SHA256 104f06b6ce2e379c3bb02cdfc1918edd3ee45e1fb3c8b5c4dcd0ab122675a964
- MD5 c913f6d16eb753431d36ea482cacb065
- SHA1 5cb1c8bdc60101846714e942758d888a008120e4
- SHA512 ebbc2aa93b22df1e8cec1889022c9f7e54cf5dbdbe6568ae39c3cd355aaab154b9b8197238682dc36143fe5fe2d25f936adb21f5101dcb5aa6570eaa8ec35ade
- MD5 SHA1 SHA512
Score

3^/10
behavioral25 behavioral26
- Target
  resources/app/node_modules/color-convert/package.json
- Size 451B
- SHA256 5a56bf5ce5ddd347644a5e7804435e583742717221d1c7024c75de766214c8f7
- MD5 8eeea2a6b7ba5169c33b486cad10ec3b
- SHA1 0e7b68e149e158306402e46aa17a06699ac79c33
- SHA512 9c505db029e4466ed62e5e69d70a7d6bb538aaeb8289c7642373e9c33af5f46cbedb6c3125ab28bb46b5ea89b56aedc6ba6b824db1eddad5f830a66d56d64efc
- MD5 SHA1 SHA512
Score

3^/10
behavioral27 behavioral28
- Target
  resources/app/node_modules/color-name/LICENSE
- Size 1KB
- SHA256 c064f7a3e353bc1bc977f3c897941c75ef763f44f41677e0a15370ca0853d6e2
- MD5 d301869b39e08b33665b7c4f16b8e41d
- SHA1 e8bc789b6dc24e4c3fc4d208364dd6b029a81eb1
- SHA512 fc1d65352c114c7594c9bedf5be432ba39d426feaf50bf8f7c52d32781323c84bfc9a68531aefb558c97ebe46e712e1d35d860ba1e1a6ab48b4a79b894092540
- MD5 SHA1 SHA512
Score

1^/10
behavioral29 behavioral30
- Target
  resources/app/node_modules/color-name/package.json
- Size 369B
- SHA256 fcae3844baef45d10ea5b3d36962c4bb517f6c0c0502da5dab6debc55c3e9359
- MD5 328719e73b38d4d0bdd56b2cb88a5feb
- SHA1 2cc0d94a27a8161ea76895b13ec73c5b2a2c97da
- SHA512 1f80c6800d4ab5da0497702c19e3d886c14da288869620050d7e81c31dcec16c8b74b9773cc94193076ceec11bd4d5a45bfcab8b3ffa692fedc29a8357a0782f
- MD5 SHA1 SHA512
Score

3^/10
behavioral31 behavioral32

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32