Extracted

• • Target

    subscription_1617291613.xlsb

  • Size

    228KB

  • MD5

    8a3364bafa63166394862068b05f5469

  • SHA1

    b039cb7a479cf118d53c61e113ad74015caadd22

  • SHA256

    3d0b681046147d8008b70bab97c41e3a21a283559874ac2ce0c518b6965312da

  • SHA512

    27c70c7fd278222a17112c0e3deb16a84f36f080a6fd933d51c4cc73392654414991ae0ba99e9760008c40a865572380c03a3b3af9297cb1a3678c630ca18111

  Score

  10^/10

  bazarloadernloaderdropperloaderpersistence

  • Bazar Loader

    Detected loader normally used to deploy BazarBackdoor malware.

    loaderdropperbazarloader

  • Nloader

    Simple loader that includes the keyword 'cambo' in the URL used to download other families.

    loadernloader

  • Process spawned unexpected child process

    This typically indicates the parent process was compromised via an exploit or macro.

  • Bazar/Team9 Loader payload

  • Nloader Payload

  • Blocklisted process makes network request

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence
  behavioral1behavioral2