zeusmuseum. - Silent Night

Silent Night (Zloader 2)

Active
600 samples
Silent Night was advertised on the exploit.in forum on November 9, 2019 by user Axe. [126]
The panel has overlaps (directory structure, function names, and database name) with a panel leaked in 2018 for a malware called "AXE Bot". [126, 127]
Based on the Silent Night version 2.1.7.0 reference sample deep dive:
- Modular
- 730 functions in loader, 1355 in main
- 108 encrypted strings in loader, 315 in main
- C2s are stored in an encrypted BaseConfig using RC4
- It uses a date-based domain generation algorithm (DGA) as a backup C2 mechanism
- Its command and control protocol is encrypted using RSA, RC4, and "visual decrypt"

References (37)

2018-06-02: AXE Bot 1.4.1 Panel [127]
2019-12-18: win.zloader [29]
2020-01-01: 1.0.8.0 Login [42]
2020-01-01: 1.0.8.0 Russian Manual [43]
2020-03-30: ~~Zeus Sphinx~~Zloader 2 Trojan Awakens Amidst Coronavirus Spam Frenzy [173]
2020-04-19: 1.1.22.0 Install [103]
2020-04-19: 1.1.22.0 Login [102]
2020-04-26: The DGA of Zloader [106]
2020-05-11: ~~Zeus Sphinx~~Zloader 2 Back in Business: Some Core Modifications Arise [118]
2020-05-21: The “Silent Night” Zloader/Zbot [126]
2020-05-21: ZLoader Loads Again: New ZLoader Variant Returns [125]
2020-05-24: Zloader String Obfuscation [142]
2020-06-11: API Hashing in the Zloader malware [143]
2020-08-11: 1.4.28.0 Install [181]
2020-10-04: 1.5.28.0 Install [215]
2020-10-25: 1.6.28.0 Install [231]
2020-10-29: The Assassin Squad: Zbot and RYUK [238]
2020-11-06: Analysis report: Beware of banking malware "Zloader" that runs behind Emotet [295]
2020-11-16: Malsmoke operators abandon exploit kits in favor of social engineering scheme [244]
2021-02-14: 1.7.x.x Install (unconfirmed) [272]
2021-03-29: Zloader email campaign using MHTML to download and decrypt XLS [288]
2021-04-20: Relation between multiple malvertisement methods of Zloader malware [291]
2021-05-14: From ZLoader to DarkSide: A Ransomware Story [294]
2021-10-18: Zloader Reversing [356]
2022-04-13: Dismantling ZLoader: How malicious ads led to disabled security tools and ransomware [401]
2022-04-13: ESET takes part in global operation to disrupt Zloader botnets [402]
2022-04-13: Microsoft ZLoader [452]
2022-04-13: Notorious cybercrime gang’s botnet disrupted [400]
2022-04-14: Zloader 2: The Silent Night [404]
2022-04-25: A Deep Dive into Zloader - the Silent Night [410]
2022-05-07: Into The Silent Night [424]
2024-01-19: Zloader: No Longer Silent in the Night [493]
2024-04-29: Zloader Learns Old Tricks [502]
2024-07-29: UNC4393 Goes Gently into the SILENTNIGHT [507]
2024-12-04: Black Basta Ransomware Campaign Drops Zbot, DarkGate, and Custom Malware [508]
2024-12-10: Inside Zloader’s Latest Trick: DNS Tunneling [509]
2025-09-22: Technical Analysis of Zloader Updates [525]

Version	Count	ITW	IOCs	Reference Sample	Notes
1.0.2.0	4	2019-12-06	Samples	f1bdd2bcbaf40bb99224fa293edc1581fd124da63c035657918877901d79bed8 (VT MB)
1.0.4.0	2	2019-12-09	Samples Webinjects	28e752ad86f8f53773bb2e147c1366f5e82b5a8fd2cd80af065decea2e11f694 (VT MB)
1.0.5.0	2	2019-12-11	Samples Webinjects	4afd18322fa314a305c50129c89764ca9f54238c5e89d86a4a312398e8e56ca8 (VT MB)
1.0.6.0	4	2019-12-16	Samples Webinjects	58afcdc59220bd54561c650d1c9f1ebed87e517dc747dfc7d243bd19708b7222 (VT MB)
1.0.7.0	1	2019-12-19	Samples Webinjects	00a2e100c5f4d7419e6612284e80b5612b080671b50f3ad9442b60e937f87967 (VT MB)
1.0.8.0	8	2019-12-23	Samples Webinjects	eafbd21a0f9f082fa2e94e010569d7fa8512d978087c2633d652b865b922465a (VT MB)
1.0.9.0	6	2019-12-26	Samples Webinjects	8d1cba212e338195e1edb8d4e4dde560fd9a36c0d177d6f5419e4e4e5e5c5b3d (VT MB)
1.0.10.0	2	2020-01-12	Samples	cad0968f5ab3bedeffef68bbe18f92946fb97967cef59970157029480ed15bb9 (VT MB)
1.0.10.1	4	2020-01-13	Samples	1233250fdba7a6a9af69091ba14ec5186c703714ff8c18c911087d16c22da64d (VT MB)
1.0.11.1	7	2020-01-13	Samples Webinjects	3428603e92a29c1d256f2d0d3c74d8dd9f8ea3eb7f56cc5204ce035395c1e3e3 (VT MB)
1.0.12.0	3	2020-01-20	Samples	97139bbaf34d92df333d9f791d12b11a8a273151edcaecb9ab7ec75bb034552f (VT MB)
1.0.13.0	1	2020-01-23	Samples	21f41071eb31d4b4f2fb1e5d9be035014b1302313804e46077ca23da0dd30bc8 (VT MB)
1.0.14.0	12	2020-01-27	Samples Webinjects	8afa8c9fc4f0d3c24dfc03477fb93c5df5e1c75b3926e5127a3d4aca6fa43a83 (VT MB)
1.0.15.0	2	2020-02-04	Samples Webinjects	66f49a261b6086dfdd1c3e2a21f7cb746aa35707490cbd64693d66383ba54c64 (VT MB)
1.0.16.0	8	2020-02-06	Samples Webinjects	a8e65df2958dddac02f2d45995ec036f94299eb9e1a4a51fbfcc717095690ce7 (VT MB)
1.0.17.0	5	2020-02-16	Samples Webinjects	e3932ab83bc05de2e91d321c4d479ff1aa3d10fdbd91e1687c80cc0ec88270e8 (VT MB)
1.0.18.0	10	2020-02-24	Samples Webinjects	38115c7bdc10cc2981e9ab126d98f5ccab66a4d4d787b90a704ba3823b07fb67 (VT MB)
1.1.18.0	1	2020-03-25	Samples	1dda49ee9286f6c433dd46056c690d02d2e7dea1f96e01dbe148136891d01bbd (VT MB)
1.1.19.0	1	2020-03-13	Samples Webinjects	ec9668cae1c65020021d2c633b68286944f1e6b1ddf5183d40ef823607e29cba (VT MB)
1.1.20.0	14	2020-03-11	Samples Webinjects	da550540689b015b44a2e03f37c23ed8c8730ccf9cb611490dc76a39782dce2b (VT MB)
1.1.21.0	17	2020-03-19	Samples Webinjects	c4f3e1c36ef734927967d40bba87fc620abe5c5049b0e67fd3cc3dab9c763c7a (VT MB)
1.1.22.0	21	2020-03-31	Samples	da550540689b015b44a2e03f37c23ed8c8730ccf9cb611490dc76a39782dce2b (VT MB)	A backup DGA was added.
1.2.22.0	6	2020-04-07	Samples	2b5e50bc3077610128051bc3e657c3f0e331fb8fed2559c6596911890ea866ba (VT MB)
1.2.23.0	45	2020-04-09	Samples	e4601ce15ad7bca4617ad033f129a5d507f8e55b979c97a78cf31a6f501cb046 (VT MB)
1.2.24.0	10	2020-05-04	Samples Webinjects	edb9d542cbc5ab07fd52792e20294f82b51de49c3d32938cbd9b55b2374d2b55 (VT MB)
1.2.25.0	38	2020-05-12	Samples Webinjects	7d5ef8e6c5738ebc13718eee67f0b6cc354f3e28b135e4a378f69d57043299b8 (VT MB)
1.3.26.0	38	2020-06-03	Samples Webinjects	a5e798492ba6892a57c79c635679563eceacb6d1efcc38f5dfc0232518861ca8 (VT MB)
1.3.27.0	53	2020-06-17	Samples Webinjects	42bb5eae534eb2cea979c300b797a65febf291b28aea0b9d8bbea7d0a41bffa2 (VT MB)
1.4.27.0	7	2020-07-20	Samples	de7da2ce5f2d7e5415bc3256cc5b7f97878ae9436497660b9add78829a8650cf (VT MB)
1.4.28.0	65	2020-08-06	Samples Webinjects	ce9d8545eb14f98f81526457b784ada2e37057dae2d74f625e47b4ed10549397 (VT MB)
1.5.28.0	32	2020-09-29	Samples Webinjects	fff929c4f44411e0f8da272f8d1db4593b23acd3c52cf8958792aef9548b4623 (VT MB)
1.6.28.0	61	2020-10-19	Samples Webinjects	c909c534b06661fb51fe27c5752aa7eca1a240200d2ff9b2d49c7baf52f3ca16 (VT MB)
1.7.28.0	11	2020-11-23	Samples	66ec83aa3631d71cba16fd34d1c0b8669009418a92ba683b8a348cd130150b5b (VT MB)
1.7.29.0	15	2020-12-08	Samples	f8503947e0e984865a29d1e3f8a62ce7034069f49c2a2dd902af68274f192224 (VT MB)
1.8.29.0	11	2021-02-08	Samples	8e50da51386c2f267afaf1a419e4467d62c01c9704f0e17c4aa188d0c090c8b2 (VT MB)
1.8.30.0	5	2021-03-22	Samples	b270e245132cf6624fc96642532a00c0a16681f59542220ad2c389d45865141f (VT MB)
2.0.0.0	3	2021-09-15	Samples	3c983bfb316b633fa71608b49f7aae4968a71d0178aef4733a86bfc99dd41f23 (VT MB)
2.0.0.0b	7	2023-12-02		038487af6226adef21a29f3d31baf3c809140fcb408191da8bc457b6721e3a55 (VT MB)	Post Microsoft takedown development.
2.1.6.0	4	2023-12-26		98dccaaa3d1efd240d201446373c6de09c06781c5c71d0f01f86b7192ec42eb2 (VT MB)
2.1.7.0	7	2023-12-22		fbd60fffb5d161e051daa3e7d65c0ad5f589687e92e43329c5c4c950f58fbb75 (VT MB)
2.4.1.0	16	2024-03-12		85962530c71cd31c102853d64a8829f93b63bd1406bdec537b9d8c200f8f0bcc (VT MB)
2.5.1.0	4	2024-03-13		85b1a980eb8ced59f87cb5dd7702e15d6ca38441c4848698d140ffd37d2b55e6 (VT MB)
2.9.4.0	24	2024-10-17		a9f2c4bc268765fc6d72d8e00363d2440cf1dcbd1ef7ee08978959fc118922c9 (VT MB)
2.11.6.0	1	2025-05-19		86ffd411b42d8d06bdb294f48e79393adeea586c56c5c75c1a68ce6315932881 (VT MB)
2.13.7.0	1	2025-06-13		01fc5c5fd03b793437ed707233d067b330fb68a2de87e9d8607c6b75caca6356 (VT MB)
2.15.12.0	1	2025-10-02		488842b8aa1131065369a897ace5f27a6934a9e4eabe6f46afe93a485707a453 (VT MB)

curator@zeusmuseum.com