zloader | f11a133498793549236370835dd628282fed30bcc123f2a4a48e6d0faeeeca1b

General

Target
tmpt7q9tx89
Size 213KB
Sample260609-gwp17aes2r
SHA256 f11a133498793549236370835dd628282fed30bcc123f2a4a48e6d0faeeeca1b
MD5 31dd83fcd01a7696ea76f960b6a05592
SHA1 246a5e37dedab118058da13d030fefc9ed92863e
SHA512 0174f6dfa9e7b9585854590d4f3706f9d0ef2a13693b111c6f5a4f4c2121163738a88a6da8c6fa1afd9f343e3dd4723ab2cdb76cb9c494f50442713311f48eae
SSDEEP 3072:eXvNgzyzRcV7oJiiZSgIMiNaY8lqNcpGnzohgp0sKB8URZQsIItcrQid/q5UtyL:oCzyyV7aZStFaY88N/nshgyp6UrJ+ft
TLSH
T13D24BF21F1E1C439E1E7267B8435C7F44EBB786616329A8F1FD906F81F246E2972530A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

zloader r2 r2 botnet discovery trojan

Malware Config

Extracted

Family

zloader

Botnet

r2

Campaign

r2

C2

https://notsweets.net/LKhwojehDgwegSDG/gateJKjdsh.php
https://olpons.com/LKhwojehDgwegSDG/gateJKjdsh.php
https://karamelliar.org/LKhwojehDgwegSDG/gateJKjdsh.php
https://dogrunn.com/LKhwojehDgwegSDG/gateJKjdsh.php
https://azoraz.net/LKhwojehDgwegSDG/gateJKjdsh.php

Attributes

build_id
136

rc4.plain

rsa_pubkey.plain

Targets

- Target
  tmpt7q9tx89
- Size 213KB
- SHA256 f11a133498793549236370835dd628282fed30bcc123f2a4a48e6d0faeeeca1b
- MD5 31dd83fcd01a7696ea76f960b6a05592
- SHA1 246a5e37dedab118058da13d030fefc9ed92863e
- SHA512 0174f6dfa9e7b9585854590d4f3706f9d0ef2a13693b111c6f5a4f4c2121163738a88a6da8c6fa1afd9f343e3dd4723ab2cdb76cb9c494f50442713311f48eae
- SSDEEP 3072:eXvNgzyzRcV7oJiiZSgIMiNaY8lqNcpGnzohgp0sKB8URZQsIItcrQid/q5UtyL:oCzyyV7aZStFaY88N/nshgyp6UrJ+ft
- TLSH
  T13D24BF21F1E1C439E1E7267B8435C7F44EBB786616329A8F1FD906F81F246E2972530A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

botnet r2 r2 discovery zloader trojan
- Family: Zloader, Terdot, DELoader, ZeusSphinx
  Zloader is a malware strain that was initially discovered back in August 2015.
  trojan botnet zloader
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Suspicious use of SetThreadContext
behavioral1 behavioral2 behavioral3

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Targets

Family: Zloader, Terdot, DELoader, ZeusSphinx

Badlisted process makes network request

Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3