Extracted

• • Target

    fa1a19977598c3f020882a4fa32e04b7_JaffaCakes118

  • Size

    165KB

  • MD5

    fa1a19977598c3f020882a4fa32e04b7

  • SHA1

    c902504f5377c31324e28801a67be6957e41271a

  • SHA256

    97139bbaf34d92df333d9f791d12b11a8a273151edcaecb9ab7ec75bb034552f

  • SHA512

    e8601a99fd078ce1084384205ea301806bafe000196fbef9bb39dbf6bc7c64e7d18bb630c11f101ae6a9776bf59ba5c9c20b1db46627d78db6a2f01912e6b06a

  • SSDEEP

    3072:S5wCoIilDFGqO9dRbhdM07CU2PpfFnjRsRfYriwa9lV7+Xeb:S2lVlEqsdPy07CU2hBORf2Za9lViXk

  Score

  10^/10

  zloadervlenie2020obnova20botnetdiscoverypersistencetrojan

  • Zloader, Terdot, DELoader, ZeusSphinx

    Zloader is a malware strain that was initially discovered back in August 2015.

    trojanbotnetzloader

  • Adds Run key to start application

    persistence

  • Blocklisted process makes network request

  • Suspicious use of SetThreadContext

  behavioral1behavioral2