Overview

overview

10

Static

static

DialogGL.EXE

windows7_x64

10

Resubmissions

16-03-2022 10:58

220316-m219ascgd6 10

16-09-2021 14:03

210916-rc1npagdel 10

15-09-2021 23:08

210915-24mw1sbeb5 1

Sharing

Copy URL
Twitter E-mail

General

  • Target

    DialogGL.EXE

  • Size

    224KB

  • Sample

    210916-rc1npagdel

  • MD5

    3e494cf9a64f6836638f8f99d4015d5b

  • SHA1

    de1d042453c77ba66bb9993c40245fd493fcb679

  • SHA256

    1625a3baefca74d244796f8ba85972350fda0994cf6752ac4d8ea8ff93052f42

  • SHA512

    e2db480175db189de53d35fe6a2318f9ccafec0ca709efa35d38444f52ab1a4db60a7ce9f4414131ee478dd262c50d904eec5eaf6fbd98b2ca2e95c590c89dee

Score
10/10
bazarloaderdropperloader

Malware Config

Targets

    • Target

      DialogGL.EXE

    • Size

      224KB

    • MD5

      3e494cf9a64f6836638f8f99d4015d5b

    • SHA1

      de1d042453c77ba66bb9993c40245fd493fcb679

    • SHA256

      1625a3baefca74d244796f8ba85972350fda0994cf6752ac4d8ea8ff93052f42

    • SHA512

      e2db480175db189de53d35fe6a2318f9ccafec0ca709efa35d38444f52ab1a4db60a7ce9f4414131ee478dd262c50d904eec5eaf6fbd98b2ca2e95c590c89dee

    Score
    10/10
    bazarloaderdropperloader

    • Bazar Loader

      Detected loader normally used to deploy BazarBackdoor malware.

      loaderdropperbazarloader

    • Bazar/Team9 Loader payload

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    behavioral1

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Install Root Certificate

1
T1130

Modify Registry

1
T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks