Overview

overview

10

Static

static

3

ZoomInstallerFull.exe

windows10-2004-x64

10

ZoomInstallerFull.exe

windows11-21h2-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    ZoomInstallerFull.exe
  • Size 122KB
  • Sample251001-xdm2wavmx9
  • SHA256 fa48ee3e0cd60dc00ecda22b6136d5312bf207bc3bfa88430230483d10e73f9a
  • MD5 SHA1 SHA512 SSDEEP
Score
10/10
cleanuploaderexecutionpersistencetrojan

Malware Config

Targets

    • Target
      ZoomInstallerFull.exe
    • Size 122KB
    • SHA256 fa48ee3e0cd60dc00ecda22b6136d5312bf207bc3bfa88430230483d10e73f9a
    • MD5 SHA1 SHA512 SSDEEP
    Score
    10/10
    executioncleanuploaderpersistencetrojan

    • CleanUpLoader, Oyster, OysterLoader

      CleanUpLoader aka Oyster is a remote access trojan written in C++, first observed in July 2023.

      trojancleanuploader

    • Cleanuploader family

      cleanuploader

    • Detects CleanupLoader/OysterLoader payload

    • Badlisted process makes network request

      Network request originating from process or tool commonly abused by malware.

    • Loads dropped DLL

    behavioral1behavioral2

MITRE ATT&CK Enterprise v16

Tasks