Overview

overview

10

Static

static

fc73b896f0...38.exe

windows7_x64

10

fc73b896f0...38.exe

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    fc73b896f01eb831e522110ad5c2e8f374d69358faa2386fdece9c17c443ce38

  • Size

    332KB

  • Sample

    201108-jr48mh64na

  • MD5

    a4ceacd31ac62ad74364d4d6d6636b8f

  • SHA1

    65067f308205376e56ec7aa24b9ef3f6d63a56d0

  • SHA256

    fc73b896f01eb831e522110ad5c2e8f374d69358faa2386fdece9c17c443ce38

  • SHA512

    269a5cbe28c0ee1561510cc0a04abd50057453b99977b41517ab2e4d8db302cf1ad9a1263475fb682d15bc672e8fc27a693a4dc19027abeb1517da99c044b237

Score
10/10
bazarbackdoorbackdoor

Malware Config

Targets

    • Target

      fc73b896f01eb831e522110ad5c2e8f374d69358faa2386fdece9c17c443ce38

    • Size

      332KB

    • MD5

      a4ceacd31ac62ad74364d4d6d6636b8f

    • SHA1

      65067f308205376e56ec7aa24b9ef3f6d63a56d0

    • SHA256

      fc73b896f01eb831e522110ad5c2e8f374d69358faa2386fdece9c17c443ce38

    • SHA512

      269a5cbe28c0ee1561510cc0a04abd50057453b99977b41517ab2e4d8db302cf1ad9a1263475fb682d15bc672e8fc27a693a4dc19027abeb1517da99c044b237

    Score
    10/10
    bazarbackdoorbackdoor

    • BazarBackdoor

      Stealthy backdoor targeting corporate networks, believed to be developed by Trickbot's authors.

      backdoorbazarbackdoor

    • Suspicious use of NtCreateProcessExOtherParentProcess

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Install Root Certificate

1
T1130

Modify Registry

1
T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks