Overview

overview

10

Static

static

12.0.dll

windows7_x64

10

12.0.dll

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    12.0

  • Size

    37KB

  • Sample

    210323-4hrptprszx

  • MD5

    af18cd9e59906e5c56bd5a07502b1f0b

  • SHA1

    3bc5960b69cbd0266e66dfea9e6d9eb6365ae78a

  • SHA256

    93db19c454405ef70de2ead0a3b2158e0d8cc8c3bb663c3af15a0df1b008fc53

  • SHA512

    35e56125884be604b45d11fc318d022bbd021ff83f8cc41fe606d91eb8f6a4770e319ff92fc9ff0119c3bbc34557be0ac41f64d90538186852269efd54144281

Score
10/10
bazarloadernloaderdropperloaderpersistence

Malware Config

Targets

    • Target

      12.0

    • Size

      37KB

    • MD5

      af18cd9e59906e5c56bd5a07502b1f0b

    • SHA1

      3bc5960b69cbd0266e66dfea9e6d9eb6365ae78a

    • SHA256

      93db19c454405ef70de2ead0a3b2158e0d8cc8c3bb663c3af15a0df1b008fc53

    • SHA512

      35e56125884be604b45d11fc318d022bbd021ff83f8cc41fe606d91eb8f6a4770e319ff92fc9ff0119c3bbc34557be0ac41f64d90538186852269efd54144281

    Score
    10/10
    nloaderloaderbazarloaderdropperpersistence

    • Bazar Loader

      Detected loader normally used to deploy BazarBackdoor malware.

      loaderdropperbazarloader

    • Nloader

      Simple loader that includes the keyword 'cambo' in the URL used to download other families.

      loadernloader

    • Bazar/Team9 Loader payload

    • Nloader Payload

    • Blocklisted process makes network request

    • Executes dropped EXE

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1
T1060

Privilege Escalation

Defense Evasion

Modify Registry

1
T1112

Credential Access

Discovery

Remote System Discovery

1
T1018

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks