ZloaderMalware
- deloader
- SILENTNIGHT
- terdot
This family describes the (initially small) loader, which downloads Zeus OpenSSL. In June 2016, a new loader was dubbed DEloader by Fortinet. It has some functions borrowed from Zeus 2.0.8[.]9 (e.g. the versioning, nrv2b, binstorage-labels), but more importantly, it downloaded a Zeus-like banking trojan (-> Zeus OpenSSL).From MISP Galaxy
Last reported 4 months ago, by Google Threat Intelligence1 report
ATT&CK techniques
6 of 36 · each with the sentence it comes from- T1003OS Credential Dumping
“OS Credential Dumping: LSASS Memory”
- T1003.001LSASS Memory
“T1003.001”
- T1003.002Security Account Manager
“T1003.002”
- T1005Data from Local System
“T1005”
- T1020Automated Exfiltration
“T1020”
- T1021.001Remote Desktop Protocol
“T1021.001”
Reports per month
last 12 monthsOctober so far (hatched). Counted by report, not by story.
What the reports say
1 report, newest first · the exact sentence from each-
Seeking Counsel: Ongoing Targeted Campaign Against US Law Firms“… on Remote Monitoring and Management (RMM) tools, unlike UNC2686 which deployed BAZARLOADER variants as well as TRICKBOT, URSNIF, and SILENTNIGHT.”
Indicators in its reports
named in the reports above- privnote[.]comin 1 report
- lockbit[.]blackin 1 report
- hxxps://business-data-leaks[.]comin 1 report
- business-data-leaks[.]comin 1 report
- itdesk[.]comin 1 report
- helpdesk[.]comin 1 report
- 192.236.147[.]131in 1 report
- 192.236.147[.]138in 1 report
- 193.141.60[.]212in 1 report
- 192.236.154[.]158in 1 report
- 192.236.146[.]173in 1 report
Copy these 11 indicators · defanged
Thanks — we review every report.