zloader | 53ebd97f9bf818a3641f51fc3bc0aa2c593b579c492eebf3b2f0df918c160f55

General

Target

e14ce3b322918b56b575b696ecae6d2d_JaffaCakes118
Size

164KB
Sample

240915-aangxavapj
MD5

e14ce3b322918b56b575b696ecae6d2d
SHA1

11fb2a04daf206b23a3a04fb8899a79d6a48293a
SHA256

53ebd97f9bf818a3641f51fc3bc0aa2c593b579c492eebf3b2f0df918c160f55
SHA512

6c95840b00d192bddf0405eb0ee39ddfa036e3d94d3bbbc4f555577a7eaa10c0325b218b7447d3cf0481b3633242e7dca7edae2bd4b802d2309571f932d534c1
SSDEEP

3072:5FikTL2T/64bzow4tZ8C5HozTSDtIQR4EIPFlm4K/cIND73CAHP:2TRzoLZ8mHoOtIykFA4KRVCAH

Score

10^/10

Malware Config

Extracted

Family

zloader

Botnet

kev

Campaign

08/02

C2

https://earfetti.com/post.php

https://evalynews.com/post.php

https://zeistatwalk.tk/post.php

https://spiraninendreamneu.tk/post.php

Attributes

build_id
332

rc4.plain

rsa_pubkey.plain

Targets

- Target
  
  e14ce3b322918b56b575b696ecae6d2d_JaffaCakes118
- Size
  
  164KB
- MD5
  
  e14ce3b322918b56b575b696ecae6d2d
- SHA1
  
  11fb2a04daf206b23a3a04fb8899a79d6a48293a
- SHA256
  
  53ebd97f9bf818a3641f51fc3bc0aa2c593b579c492eebf3b2f0df918c160f55
- SHA512
  
  6c95840b00d192bddf0405eb0ee39ddfa036e3d94d3bbbc4f555577a7eaa10c0325b218b7447d3cf0481b3633242e7dca7edae2bd4b802d2309571f932d534c1
- SSDEEP
  
  3072:5FikTL2T/64bzow4tZ8C5HozTSDtIQR4EIPFlm4K/cIND73CAHP:2TRzoLZ8mHoOtIykFA4KRVCAH
Score

5^/10

discovery
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Targets

Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks

static1

behavioral1

behavioral2