Overview

overview

10

Static

static

Preview.exe

windows7_x64

10

Preview.exe

windows10_x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    Preview.exe
  • Size 394KB
  • Sample200923-klynrr94js
  • SHA256 7b86d02140dd6e4b537d1ca6a7a7ec8df70caaece6db092b13da58633f055f9d
  • MD5 SHA1 SHA512
Score
10/10
bazarbackdoorbazarloaderbackdoordropperloader

Malware Config

Targets

    • Target
      Preview.exe
    • Size 394KB
    • SHA256 7b86d02140dd6e4b537d1ca6a7a7ec8df70caaece6db092b13da58633f055f9d
    • MD5 SHA1 SHA512
    Score
    10/10
    bazarloaderdropperloaderbazarbackdoorbackdoor

    • Bazar Loader

      Detected loader normally used to deploy BazarBackdoor malware.

      loaderdropperbazarloader

    • BazarBackdoor

      Stealthy backdoor targeting corporate networks, believed to be developed by Trickbot's authors.

      backdoorbazarbackdoor

    • Bazar/Team9 Backdoor payload

    • Bazar/Team9 Loader payload

    • Tries to connect to .bazar domain

      Attempts to lookup or connect to a .bazar domain, used by BazarBackdoor, Trickbot, and potentially others.

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks