Hello and welcome to a new section.
In this new session, we are going to unpack the Zloader Trojan and here is some write up on the Zloader
Trojan.
The Z loader Trojan is a variant of the Zeus malware Trojan that hit the banking industry beginning
in 2006 and recently has been used in over 100 attack campaigns since that date.
Z loader relies on the emails containing Covid 19 layers that recent incarnations of Zeus has also been
using.
Taking a step further, Z Loader also uses other layers such as malicious resume series invoices and
Excel attachments.
As of May 20th, 2020, researchers were discovering one new campaign of xeloda each day.
How Xeloda works.
Xeloda is spread through aggressive email campaigns, where the email contains a malicious attachment
with a provocative title referring to either Covid 19 or seeking a job and invoices with links to infected
Microsoft Word files.
In the case of the invoice, email users will download the malware installer and when they click the
enable content button on the document.
So that's some background on Xeloda.
Go and download the loader and from the resource section and unzip it.
Put it on the folder in the desktop called Xeloda and you will notice Xeloda is a file dynamic link
library.
So we will now take a look at p-studio.
So open up vs studio from Flair utilities.
And drag Zloader into studio.
And you see here the entropy is 6.432.
But that is quite misleading.
Even though it's less than seven, meaning it is unpacked.
In actuality, it is packed.
It's a 32 bit program.
And then over here in the file header, the compiler stamp is April 24th, 2020 Sections 4.2. Data dot
Data dot Resource dot reloc.
Libraries.
Three libraries.
Kernel32 uses 32 at vaapi 32 and contains about 100 imports.
Here are the some of the imports.
Quite a lot of them.
100 imports.
And you can see his debugger present is there as well.
Under resources, you can see string tables version and manifest under strings, mostly encrypted.
This lends credence to the fact that it is a packed executable version is double double band.
The company name is the movie SIM SIM must as a file description.
So let us now try to unpack this with X32 DBG.
So fire up your x32 dbg.
Under the options Preferences, uncheck System, breakpoint and callbacks.
Click save and then open the Trojan.
Immediately downloader is fired up in order to load your DSL.
So that is quite normal.
Just leave it alone.
Now we shall set some breakpoints.
First breakpoint is Virtualalloc.
Hit.
Enter.
Click on the breakpoints tab.
Keep an eye on the breakpoints.
Second breakpoint is Virtualprotect.
Hit Enter.
Third breakpoint is create process internal w.
Hit enter for breakpoint is w present
is debugger present.
Next.
Go up to the breakpoints that confirm that all the breakpoints are set.
Then go to the CPU and hit Run or F9.
And now it is running.
It will take some time to unpack the code.
So just let it run.
Finally, it has hit a breakpoint.
Virtual lock.
So we can step over this,
jump to virtual lock and then come to the call here.
The virtual call step will wait and look at the X.
We are going to follow this in time.
So right click, follow in dump, which is currently dump number one over here, then F9 to run again.
In his virtual alloc a second time.
Again we step over it.
Come to the virtual alloc call this one step over and look at X.
This time we are going to follow in dump number two.
So select dump number two.
Right click on the X and follow in dump.
And it is now being followed in dump number two.
Meanwhile, dump number one, you will see that it has populated it with some shell code.
Dum dum, dum.
Is still empty.
Now we hit F9 again.
Or this icon here.
It hits Virtualalloc for the third time and we shall step over it again.
Jump, jump, step over until we come to this virtual call where we step over it again and look at X.
This time we click on Done number three because we want to follow it in.
Done number three.
So we right click on X register and select following Done.
And now we are following done number three.
Meanwhile, done number two has been populated with some shell code.
So presently done.
One and two, we can find some unpacked code.
So we now have done number three and then we click on F9 to run again.
And this time it hits virtual protect.
So at this point in time, we will pause here and we will continue in the next video.
Thank you for watching.