zloader | d0bef870592d1095d72178c27b2ce81dc94163aa30fa0742d6d428a1485ae459

General

Target
tmps0r4b8y3
Size 285KB
Sample260602-g73resfs4x
SHA256 d0bef870592d1095d72178c27b2ce81dc94163aa30fa0742d6d428a1485ae459
MD5 bcdae9f51c056a8bdfda1ab7dd9291f9
SHA1 e25e061296177376ffb63a8679dab6294609d436
SHA512 06e2843889fdc5106af1e92047f14b49c01b1d6601225083f370fee355d58d7ea1d180ade81fde03d10b752fba0a4096193edfae5360473af5dcd930b67109b9
SSDEEP 3072:fjnDk9LzxWoER2GsQjMBiaf/UABDjX8guvrJ6tAQBRhxBhWdGrOJhjNS6O:fbwVxWo8sQIBiYTDjru16NOJhC
TLSH
T1EA54DF2276E0C432C177413416A2D7B16A3E78312B7499CB7B9A173E5F313C16E3A79A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

zloader r2 r2 botnet discovery trojan

Malware Config

Extracted

Family

zloader

Botnet

r2

Campaign

r2

C2

https://notsweets.net/LKhwojehDgwegSDG/gateJKjdsh.php
https://olpons.com/LKhwojehDgwegSDG/gateJKjdsh.php
https://karamelliar.org/LKhwojehDgwegSDG/gateJKjdsh.php
https://dogrunn.com/LKhwojehDgwegSDG/gateJKjdsh.php
https://azoraz.net/LKhwojehDgwegSDG/gateJKjdsh.php

Attributes

build_id
136

rc4.plain

rsa_pubkey.plain

Targets

- Target
  tmps0r4b8y3
- Size 285KB
- SHA256 d0bef870592d1095d72178c27b2ce81dc94163aa30fa0742d6d428a1485ae459
- MD5 bcdae9f51c056a8bdfda1ab7dd9291f9
- SHA1 e25e061296177376ffb63a8679dab6294609d436
- SHA512 06e2843889fdc5106af1e92047f14b49c01b1d6601225083f370fee355d58d7ea1d180ade81fde03d10b752fba0a4096193edfae5360473af5dcd930b67109b9
- SSDEEP 3072:fjnDk9LzxWoER2GsQjMBiaf/UABDjX8guvrJ6tAQBRhxBhWdGrOJhjNS6O:fbwVxWo8sQIBiYTDjru16NOJhC
- TLSH
  T1EA54DF2276E0C432C177413416A2D7B16A3E78312B7499CB7B9A173E5F313C16E3A79A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

botnet r2 r2 discovery zloader trojan
- Family: Zloader, Terdot, DELoader, ZeusSphinx
  Zloader is a malware strain that was initially discovered back in August 2015.
  trojan botnet zloader
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Suspicious use of SetThreadContext
behavioral1 behavioral2 behavioral3

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Targets

Family: Zloader, Terdot, DELoader, ZeusSphinx

Suspicious use of NtCreateUserProcessOtherParentProcess

Badlisted process makes network request

Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3