Extracted

• • Target

    Stolen Images Evidence.js

  • Size

    18KB

  • MD5

    72217c4045c79d272f61a11845b6b660

  • SHA1

    19d37ee5bf8cf53fcf6c24a5d2635a3c4dbb1a81

  • SHA256

    4540b8ddc48ded9be70cbefdd11a5c2f3745f684adac2d7a3ca5976cb811104d

  • SHA512

    250ffe4fd5ff60206fc39a225ad8318ae206fb883ed8246180b2a867f75b67dabfff5eed4f29e7c9a1396b6874906132dbd7ad13976b55e2c5769d359be27823

  Score

  10^/10

  bazarloaderdropperloaderbazarbackdoorbackdoor

  • Bazar Loader

    Detected loader normally used to deploy BazarBackdoor malware.

    loaderdropperbazarloader

  • BazarBackdoor

    Stealthy backdoor targeting corporate networks, believed to be developed by Trickbot's authors.

    backdoorbazarbackdoor

  • Bazar/Team9 Backdoor payload

  • Bazar/Team9 Loader payload

  • Blocklisted process makes network request

  • Tries to connect to .bazar domain

    Attempts to lookup or connect to a .bazar domain, used by BazarBackdoor, Trickbot, and potentially others.

  • Loads dropped DLL

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2