Overview

overview

10

Static

static

3

d00f081809...18.dll

windows7-x64

10

d00f081809...18.dll

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    d00f0818093c5960cb3ea0de3b93f341_JaffaCakes118

  • Size

    364KB

  • Sample

    240906-vwd6ksycqk

  • MD5

    d00f0818093c5960cb3ea0de3b93f341

  • SHA1

    a7bdf8da3a30ac98a0df9fd0bd50f61a330056f1

  • SHA256

    e3c48c72d0d090ac01bff8bf6d54c08a6fedcda2e527d424d6f64a70016d2ba6

  • SHA512

    681fe9460252b315e6bc976793b0a594cfc501ad574b03525597aa0d5342201672811cf6bd86b5412d9a43df5500e43f28bdab1e5ca361e431532ecce5e5ca05

  • SSDEEP

    6144:gzAILNLdvVA988yVzjtSYnY8NcE2mzWHRYLk1KZELZkwhg2x9xbYn4g2zlw:gLZ6lyVJnNNjzW9wZELOqc4g

Score
10/10
zloaderapr09canadabotnetdiscoverytrojan

Malware Config

Extracted

Family

zloader

Botnet

apr09

Campaign

Canada

C2

http://march262020.best/post.php

http://march262020.club/post.php

http://march262020.com/post.php

http://march262020.live/post.php

http://march262020.network/post.php

http://march262020.online/post.php

http://march262020.site/post.php

http://march262020.store/post.php

http://march262020.tech/post.php
Attributes
  • build_id

    94

rc4.plain

Targets

    • Target

      d00f0818093c5960cb3ea0de3b93f341_JaffaCakes118

    • Size

      364KB

    • MD5

      d00f0818093c5960cb3ea0de3b93f341

    • SHA1

      a7bdf8da3a30ac98a0df9fd0bd50f61a330056f1

    • SHA256

      e3c48c72d0d090ac01bff8bf6d54c08a6fedcda2e527d424d6f64a70016d2ba6

    • SHA512

      681fe9460252b315e6bc976793b0a594cfc501ad574b03525597aa0d5342201672811cf6bd86b5412d9a43df5500e43f28bdab1e5ca361e431532ecce5e5ca05

    • SSDEEP

      6144:gzAILNLdvVA988yVzjtSYnY8NcE2mzWHRYLk1KZELZkwhg2x9xbYn4g2zlw:gLZ6lyVJnNNjzW9wZELOqc4g

    Score
    10/10
    zloaderapr09canadabotnetdiscoverytrojan

    • Zloader, Terdot, DELoader, ZeusSphinx

      Zloader is a malware strain that was initially discovered back in August 2015.

      trojanbotnetzloader

    • Blocklisted process makes network request

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks