Overview

overview

10

Static

static

UAKahml.dat.dll

windows7_x64

10

UAKahml.dat.dll

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    UAKahml.dat

  • Size

    512KB

  • Sample

    211007-wdjtsadacm

  • MD5

    6e2316bb2c6cb9c5e3c26398574e5548

  • SHA1

    81be2c346afec4bc248f6332bcb287b3bb6ea547

  • SHA256

    016a36baa939016b069f379a632769eca6e77639543283583b1d5b675065279f

  • SHA512

    c8efe49ab78db3f9e7e246ecd3624d91d16f076409414181a006e336640fc9b388acc8252a462241ca52afd6bc8265036fb40eff8e631c2f347af2389b821455

Score
10/10
bazarbackdoorbazarloaderbackdoordropperloader

Malware Config

Targets

    • Target

      UAKahml.dat

    • Size

      512KB

    • MD5

      6e2316bb2c6cb9c5e3c26398574e5548

    • SHA1

      81be2c346afec4bc248f6332bcb287b3bb6ea547

    • SHA256

      016a36baa939016b069f379a632769eca6e77639543283583b1d5b675065279f

    • SHA512

      c8efe49ab78db3f9e7e246ecd3624d91d16f076409414181a006e336640fc9b388acc8252a462241ca52afd6bc8265036fb40eff8e631c2f347af2389b821455

    Score
    10/10
    bazarbackdoorbazarloaderbackdoordropperloader

    • Bazar Loader

      Detected loader normally used to deploy BazarBackdoor malware.

      loaderdropperbazarloader

    • BazarBackdoor

      Stealthy backdoor targeting corporate networks, believed to be developed by Trickbot's authors.

      backdoorbazarbackdoor

    • Bazar/Team9 Backdoor payload

    • Bazar/Team9 Loader payload

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks