Overview

overview

10

Static

static

vWJpojwO.dll

windows7_x64

10

vWJpojwO.dll

windows10_x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    vWJpojwO.dll
  • Size 494KB
  • Sample210729-wp4mbab14a
  • SHA256 986d22f03f04424181bc773a42db6283722baffe40b031d97c9562ab0ed8a6ae
  • MD5 SHA1 SHA512
Score
10/10
bazarbackdoorbackdoorsuricata

Malware Config

Targets

    • Target
      vWJpojwO.dll
    • Size 494KB
    • SHA256 986d22f03f04424181bc773a42db6283722baffe40b031d97c9562ab0ed8a6ae
    • MD5 SHA1 SHA512
    Score
    10/10
    bazarbackdoorbackdoorsuricata

    • BazarBackdoor

      Stealthy backdoor targeting corporate networks, believed to be developed by Trickbot's authors.

      backdoorbazarbackdoor

    • suricata: ET MALWARE Observed Malicious SSL Cert (BazaLoader CnC)

      suricata

    • suricata: ET MALWARE Observed Malicious SSL Cert (Bazar Backdoor)

      suricata

    • Bazar/Team9 Backdoor payload

    • Blocklisted process makes network request

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks