Overview

overview

10

Static

static

zloader 2_...ir.exe

windows7_x64

10

zloader 2_...ir.exe

windows10_x64

8

Resubmissions

19-07-2023 11:14

230719-nb99yscg87 10

19-07-2020 19:33

200719-m964m1njqe 10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    zloader 2_1.0.13.0.vir

  • Size

    154KB

  • Sample

    200719-m964m1njqe

  • MD5

    07e6b50724981e0c96f7d23f48d309b5

  • SHA1

    0c012857690e0eebf10eb0ccafcbad9434f99d91

  • SHA256

    21f41071eb31d4b4f2fb1e5d9be035014b1302313804e46077ca23da0dd30bc8

  • SHA512

    e930617c54fee9fbc9cfb37d6a014e808556f55306d50e2b83c81ef9478772ff4be4e86d55f03879ab5d0cba6a796268dbfb9ac06b2350502bbf56286dc83102

Score
10/10
zloadervlenie2020obnova20botnetpersistencetrojan

Malware Config

Extracted

Family

zloader

Botnet

vlenie2020

Campaign

obnova20

C2

https://dasifosafjasfhasf.com/gate.php

https://kasfajfsafhasfhaf.com/gate.php

https://fdsjfjdsfjdsjfdjsfh.com/gate.php

https://fdsjfjdsfjdsdsjajjs.com/gate.php

https://idisaudhasdhasdj.com/gate.php

https://dsjdjsjdsadhasdas.com/gate.php

https://dsdjfhdsufudhjas.com/gate.php
rc4.plain

Targets

    • Target

      zloader 2_1.0.13.0.vir

    • Size

      154KB

    • MD5

      07e6b50724981e0c96f7d23f48d309b5

    • SHA1

      0c012857690e0eebf10eb0ccafcbad9434f99d91

    • SHA256

      21f41071eb31d4b4f2fb1e5d9be035014b1302313804e46077ca23da0dd30bc8

    • SHA512

      e930617c54fee9fbc9cfb37d6a014e808556f55306d50e2b83c81ef9478772ff4be4e86d55f03879ab5d0cba6a796268dbfb9ac06b2350502bbf56286dc83102

    Score
    10/10
    persistencetrojanbotnetzloader

    • Zloader, Terdot, DELoader, ZeusSphinx

      Zloader is a malware strain that was initially discovered back in August 2015.

      trojanbotnetzloader

    • Blacklisted process makes network request

    • Adds Run key to start application

      persistence

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1
T1060

Privilege Escalation

Defense Evasion

Modify Registry

1
T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks