Overview

overview

10

Static

static

KQdFq.dat.dll

windows7_x64

10

KQdFq.dat.dll

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    KQdFq.dat

  • Size

    409KB

  • Sample

    210727-bdc63ttvha

  • MD5

    1d78af63cf39db93255eba78c469a598

  • SHA1

    6a41ff9c6f64875b29bc94dc110a7ec844dbbe45

  • SHA256

    80ebf667875c94175c392e21ed3e52fc1ebf7f2460fd8a82d5cde4c732612762

  • SHA512

    8f636135d412712196886c3a6193343ceb18f618e0e8d5248bdd3f06db5a6d2b2d2dbd474be246ab906f4a97b09f4680b10ec78ba38470f2db8cbb32ed251ed3

Score
10/10
suricata

Malware Config

Targets

    • Target

      KQdFq.dat

    • Size

      409KB

    • MD5

      1d78af63cf39db93255eba78c469a598

    • SHA1

      6a41ff9c6f64875b29bc94dc110a7ec844dbbe45

    • SHA256

      80ebf667875c94175c392e21ed3e52fc1ebf7f2460fd8a82d5cde4c732612762

    • SHA512

      8f636135d412712196886c3a6193343ceb18f618e0e8d5248bdd3f06db5a6d2b2d2dbd474be246ab906f4a97b09f4680b10ec78ba38470f2db8cbb32ed251ed3

    Score
    10/10
    suricata

    • Suspicious use of NtCreateUserProcessOtherParentProcess

    • suricata: ET MALWARE BazaLoader Activity (GET)

      suricata

    • suricata: ET MALWARE Observed Malicious SSL Cert (BazaLoader CnC)

      suricata

    • suricata: ET MALWARE Observed Malicious SSL Cert (Bazar Backdoor)

      suricata

    • Blocklisted process makes network request

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks