Overview

overview

10

Static

static

09da6102c6...fa.exe

windows7_x64

10

09da6102c6...fa.exe

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    09da6102c6b77c609537c5b3d8bf9de8f4143d533856d174929859feda5806fa

  • Size

    332KB

  • Sample

    201110-lax9zeqvbn

  • MD5

    830b5861063e0d5a94b9b895f5b58fe5

  • SHA1

    26b6a975f3af21eb43986e08b5b5472e6dcbf770

  • SHA256

    09da6102c6b77c609537c5b3d8bf9de8f4143d533856d174929859feda5806fa

  • SHA512

    b8a6f4c9d469cc2b903338deb47758acc7fe92aab8fcc096d3e54cf3ab8134caa62dde9a20e88f05a1a0c6f8645f66d2d34dfdd3571551c66e5b7d8aef7893b8

Score
10/10
bazarbackdoorbackdoor

Malware Config

Targets

    • Target

      09da6102c6b77c609537c5b3d8bf9de8f4143d533856d174929859feda5806fa

    • Size

      332KB

    • MD5

      830b5861063e0d5a94b9b895f5b58fe5

    • SHA1

      26b6a975f3af21eb43986e08b5b5472e6dcbf770

    • SHA256

      09da6102c6b77c609537c5b3d8bf9de8f4143d533856d174929859feda5806fa

    • SHA512

      b8a6f4c9d469cc2b903338deb47758acc7fe92aab8fcc096d3e54cf3ab8134caa62dde9a20e88f05a1a0c6f8645f66d2d34dfdd3571551c66e5b7d8aef7893b8

    Score
    10/10
    bazarbackdoorbackdoor

    • BazarBackdoor

      Stealthy backdoor targeting corporate networks, believed to be developed by Trickbot's authors.

      backdoorbazarbackdoor

    • Suspicious use of NtCreateProcessExOtherParentProcess

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Install Root Certificate

1
T1130

Modify Registry

1
T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks