Overview

overview

10

Static

static

galadriel

windows7_x64

10

Eternity

windows7_x64

10

Resubmissions

17/03/2021, 11:14

210317-18w814yayn5

11/12/2020, 06:15

201211-s3m1gmsy9e10

10/12/2020, 17:48

201210-kdnjenxb5s10

10/12/2020, 17:39

201210-y8eh5tnflx5

Sharing

Copy URL Twitter E-mail

General

  • Target
    PreviewDoc.exe
  • Size 506KB
  • Sample201210-kdnjenxb5s
  • SHA256 bcea99b1ec6fa52fec60589878c451266f260a8b4e2d8c85d700b3d24e0dce4b
  • MD5 SHA1 SHA512
Score
10/10
bazarbackdoorbazarloaderbackdoordropperloader

Malware Config

Targets

    • Target
      PreviewDoc.exe
    • Size 506KB
    • SHA256 bcea99b1ec6fa52fec60589878c451266f260a8b4e2d8c85d700b3d24e0dce4b
    • MD5 SHA1 SHA512
    Score
    10/10
    bazarloaderdropperloaderbazarbackdoorbackdoor

    • Bazar Loader

      Detected loader normally used to deploy BazarBackdoor malware.

      loaderdropperbazarloader

    • BazarBackdoor

      Stealthy backdoor targeting corporate networks, believed to be developed by Trickbot's authors.

      backdoorbazarbackdoor

    • Suspicious use of NtCreateUserProcessOtherParentProcess

    • Bazar/Team9 Backdoor payload

    • Bazar/Team9 Loader payload

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks