ThreatLabz

Executive Summary: This report provides a technical analysis of Zloader v2.4.1.0/2.5.1.0 anti-analysis features: samples create and validate a per-sample registry key/value derived from a pseudo-random seed and perform a secondary MZ-header DWORD check that prevents reinstallation on other systems unless patched; it documents the RC4-encrypted 1,418-byte registry payload and compares the approach to Zeus's historical PeSettings overlay.