General

  • Target

    zloader 2_1.0.10.0.vir

  • Size

    139KB

  • Sample

    200719-c8eznxrr32

  • MD5

    d91b498e5fc6c91e1e86b339407b58f7

  • SHA1

    369e3c4646a69b99a797e0e288fd3145e2a6f35a

  • SHA256

    cad0968f5ab3bedeffef68bbe18f92946fb97967cef59970157029480ed15bb9

  • SHA512

    b981f7c4857327708233bf7e44bfb485c1cc7148ca850a63b12f854215edb583f5a499109d67b94f213226d23d0f4e0e5d04b888193fa5e799e30f051e9c9dbd

Malware Config

Extracted

Family

zloader

Botnet

vlenie10

Campaign

obnova10

C2

https://kdsidsiadsakfsas.com/gate.php

https://jdafiasfjsafahhfs.com/gate.php

https://dasifosafjasfhasf.com/gate.php

https://kasfajfsafhasfhaf.com/gate.php

https://fdsjfjdsfjdsjfdjsfh.com/gate.php

https://fdsjfjdsfjdsdsjajjs.com/gate.php

https://idisaudhasdhasdj.com/gate.php

https://dsjdjsjdsadhasdas.com/gate.php

https://dsdjfhdsufudhjas.com/gate.php

rc4.plain

Targets

    • Target

      zloader 2_1.0.10.0.vir

    • Size

      139KB

    • MD5

      d91b498e5fc6c91e1e86b339407b58f7

    • SHA1

      369e3c4646a69b99a797e0e288fd3145e2a6f35a

    • SHA256

      cad0968f5ab3bedeffef68bbe18f92946fb97967cef59970157029480ed15bb9

    • SHA512

      b981f7c4857327708233bf7e44bfb485c1cc7148ca850a63b12f854215edb583f5a499109d67b94f213226d23d0f4e0e5d04b888193fa5e799e30f051e9c9dbd

    • Zloader, Terdot, DELoader, ZeusSphinx

      Zloader is a malware strain that was initially discovered back in August 2015.

    • Blacklisted process makes network request

    • Adds Run key to start application

    • Suspicious use of SetThreadContext

MITRE ATT&CK Matrix ATT&CK v6

Persistence

Registry Run Keys / Startup Folder

1
T1060

Defense Evasion

Modify Registry

2
T1112

Install Root Certificate

1
T1130

Discovery

Query Registry

1
T1012

System Information Discovery

1
T1082

Tasks