Overview

overview

10

Static

static

10

e356413858...18.dll

windows7-x64

10

e356413858...18.dll

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    e3564138588cba04c873bd054458f8b9_JaffaCakes118

  • Size

    111KB

  • Sample

    240915-zph86ssfnn

  • MD5

    e3564138588cba04c873bd054458f8b9

  • SHA1

    157ec7421e1333b714d01a750b6d5d6517a92c45

  • SHA256

    e3932ab83bc05de2e91d321c4d479ff1aa3d10fdbd91e1687c80cc0ec88270e8

  • SHA512

    2a2e8ce45a928bcffdb40ebf6559c1f071bb3feccfd9cfe355e593acb559ecf84858cf4474708d311317ab08b3f981eba7c8b80dceae973839a0eec9049665c8

  • SSDEEP

    1536:3ui/9Xb791Wff4K84oeRnobxxm2ShclQaLMin8F5vAC+WEQbAmTjTpeyv0+gPzff:H/J7jWHT/oegcaQF5XEgHbpeyvfgT

Score
10/10
zloaderdllobnova1017botnetdiscoverypersistencetrojan

Malware Config

Extracted

Family

zloader

Botnet

DLLobnova

Campaign

1017

C2

https://fdsjfjdsfjdsjfdjsfh.com/gate.php

https://fdsjfjdsfjdsdsjajjs.com/gate.php

https://idisaudhasdhasdj.com/gate.php

https://dsjdjsjdsadhasdas.com/gate.php

https://dsdjfhdsufudhjas.com/gate.php

https://dsdjfhdsufudhjas.info/gate.php

https://fdsjfjdsfjdsdsjajjs.info/gate.php

https://idisaudhasdhasdj.info/gate.php
Attributes
  • build_id

    28

rc4.plain

Targets

    • Target

      e3564138588cba04c873bd054458f8b9_JaffaCakes118

    • Size

      111KB

    • MD5

      e3564138588cba04c873bd054458f8b9

    • SHA1

      157ec7421e1333b714d01a750b6d5d6517a92c45

    • SHA256

      e3932ab83bc05de2e91d321c4d479ff1aa3d10fdbd91e1687c80cc0ec88270e8

    • SHA512

      2a2e8ce45a928bcffdb40ebf6559c1f071bb3feccfd9cfe355e593acb559ecf84858cf4474708d311317ab08b3f981eba7c8b80dceae973839a0eec9049665c8

    • SSDEEP

      1536:3ui/9Xb791Wff4K84oeRnobxxm2ShclQaLMin8F5vAC+WEQbAmTjTpeyv0+gPzff:H/J7jWHT/oegcaQF5XEgHbpeyvfgT

    Score
    10/10
    zloaderdllobnova1017botnetdiscoverypersistencetrojan

    • Zloader, Terdot, DELoader, ZeusSphinx

      Zloader is a malware strain that was initially discovered back in August 2015.

      trojanbotnetzloader

    • Adds Run key to start application

      persistence

    • Blocklisted process makes network request

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks