Zloader Analysis

ThreatLabz provides a technical analysis of updated Zloader variants that implement enhanced anti-analysis (runtime API hashing with a changing XOR, junk arithmetic code, filename-based sandbox evasion, and string obfuscation), a modified static config containing a bundled RSA public key, a new DGA producing 32 .com domains per day, and network encryption using 1024-bit RSA + RC4 with the Zeus BinStorage/visual encryption format; the report includes IOCs (expected filenames, botnet IDs such as Bing_Mod5, campaign ID 'M1', and the embedded RSA public key) and notes 15 observed samples likely associated with a single actor.