Overview

overview

10

Static

static

6

Report-Rev...10.exe

windows7_x64

1

Report-Rev...10.exe

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    Report-Review26-10.exe

  • Size

    8.7MB

  • Sample

    201026-56rkwzhk26

  • MD5

    17ef6bf7f2b5bcbc91b0cc4effe05685

  • SHA1

    6b351810ab6d25ebd9fd5a00b46a2791a042d413

  • SHA256

    46e2ef1636fd374e9698e888e5f712253811651ebb88ce098573235189a5072c

  • SHA512

    0b27c81b5be2fb14d6383f1b1ae059b616b2c1887880a8578c06bc44352d5aec4c88aa184e07cc96d667c3f0a14fafdacc3dd1dac7e16ae8ee9e699baa53121d

Score
10/10
bazarbackdoorbackdoor

Malware Config

Targets

    • Target

      Report-Review26-10.exe

    • Size

      8.7MB

    • MD5

      17ef6bf7f2b5bcbc91b0cc4effe05685

    • SHA1

      6b351810ab6d25ebd9fd5a00b46a2791a042d413

    • SHA256

      46e2ef1636fd374e9698e888e5f712253811651ebb88ce098573235189a5072c

    • SHA512

      0b27c81b5be2fb14d6383f1b1ae059b616b2c1887880a8578c06bc44352d5aec4c88aa184e07cc96d667c3f0a14fafdacc3dd1dac7e16ae8ee9e699baa53121d

    Score
    10/10
    backdoorbazarbackdoor

    • BazarBackdoor

      Stealthy backdoor targeting corporate networks, believed to be developed by Trickbot's authors.

      backdoorbazarbackdoor

    • Blacklisted process makes network request

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Install Root Certificate

1
T1130

Modify Registry

1
T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks