Overview

overview

10

Static

static

1

6aee58b638...18.dll

windows7-x64

10

6aee58b638...18.dll

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    6aee58b63843a0d73a98a2922092de8a_JaffaCakes118

  • Size

    839KB

  • Sample

    240730-a1g3tatcnb

  • MD5

    6aee58b63843a0d73a98a2922092de8a

  • SHA1

    abc6ac9a98360aa065f32e15d0a9293f8aa26e32

  • SHA256

    fff929c4f44411e0f8da272f8d1db4593b23acd3c52cf8958792aef9548b4623

  • SHA512

    ab93f97b94953edc7d051ffa48cf444d4f09af479746ad88b86907e50d8984919fa1fdef473b2cb73adcb23378c03a81a06eece1cf7b1d12a469c0eec943d20c

  • SSDEEP

    6144:XkX7Ahus9knpaHe51x/ZD6KJ02lclcB6BQVnhLbm6BN6BILsWwrdsWhc:0Ehus+5rZDjJ025oQVhX3UjdrdsWy

Score
10/10
zloaderxls_spam_2809divaderbotnetdiscoverypersistencetrojan

Malware Config

Extracted

Family

zloader

Botnet

xls_spam_2809

Campaign

divader

C2

https://fqnesas.ru/gate.php

https://fqnvsdaas.su/gate.php

https://fqnvtmqass.ru/gate.php

https://fqnvtcpheas.su/gate.php

https://fqnvtmophfeas.ru/gate.php

https://fqnceas.su/gate.php

https://fqlocpeas.ru/gate.php

https://dksaiijn.ru/gate.php

https://dksafjasnf.su/gate.php

https://fjsafasfsa.ru/gate.php
Attributes
  • build_id

    80

rc4.plain
rsa_pubkey.plain

Targets

    • Target

      6aee58b63843a0d73a98a2922092de8a_JaffaCakes118

    • Size

      839KB

    • MD5

      6aee58b63843a0d73a98a2922092de8a

    • SHA1

      abc6ac9a98360aa065f32e15d0a9293f8aa26e32

    • SHA256

      fff929c4f44411e0f8da272f8d1db4593b23acd3c52cf8958792aef9548b4623

    • SHA512

      ab93f97b94953edc7d051ffa48cf444d4f09af479746ad88b86907e50d8984919fa1fdef473b2cb73adcb23378c03a81a06eece1cf7b1d12a469c0eec943d20c

    • SSDEEP

      6144:XkX7Ahus9knpaHe51x/ZD6KJ02lclcB6BQVnhLbm6BN6BILsWwrdsWhc:0Ehus+5rZDjJ025oQVhX3UjdrdsWy

    Score
    10/10
    zloaderxls_spam_2809divaderbotnetdiscoverypersistencetrojan

    • Zloader, Terdot, DELoader, ZeusSphinx

      Zloader is a malware strain that was initially discovered back in August 2015.

      trojanbotnetzloader

    • Adds Run key to start application

      persistence

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks