Extracted

• • Target

    bakjr.exe

  • Size

    248KB

  • MD5

    bb5ef523f0bf243790b6c67dd77ee986

  • SHA1

    cbfe325c2101c5f76a3675b23b459eeb641eecb6

  • SHA256

    c51bf8c74311b8941dca2f63a0850e61c1058af6af0ac42d81c2d85cd64d37cb

  • SHA512

    eb9ffe004187d6174cf0cc2f85184e5a524546e1bc7139c1f16147049eadbd92f94818ea618370450779753c87d8349efe255244eef2450e16f9446799cdeef2

  Score

  10^/10

  bazarbackdoorbazarloaderbackdoordropperloader

  • Bazar Loader

    Detected loader normally used to deploy BazarBackdoor malware.

    loaderdropperbazarloader

  • BazarBackdoor

    Stealthy backdoor targeting corporate networks, believed to be developed by Trickbot's authors.

    backdoorbazarbackdoor

  • Bazar/Team9 Backdoor payload

  • Bazar/Team9 Loader payload

  • Blocklisted process makes network request

  • Suspicious use of SetThreadContext

  behavioral1behavioral2

• • Target

    subscription_1618420095.xlsb

  • Size

    254KB

  • MD5

    dc37192b5c4c8c4f94c73c18ce5e3829

  • SHA1

    0aa6bb11a11dade2269d90b2781ed0a517362012

  • SHA256

    db53f42e13d2685bd34dbc5c79fad637c9344e72e210ca05504420874e98c2a6

  • SHA512

    3e8b179d8521fb33a46eeeca74bbda7a4e8a32f47b6195b17d62664dd2e31716261a61a495857ed08dbbc001a9eab8adec7133921179eb3df66c53e18c586d9a

  Score

  10^/10

  nloaderloader

  • Nloader

    Simple loader that includes the keyword 'campo' in the URL used to download other families.

    loadernloader

  • Process spawned unexpected child process

    This typically indicates the parent process was compromised via an exploit or macro.

  • Nloader Payload

  • Blocklisted process makes network request

  • Loads dropped DLL

  behavioral3behavioral4