Overview

overview

10

Static

static

Stolen Ima...nce.js

windows7_x64

10

Stolen Ima...nce.js

windows10_x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    Stolen Images Evidence.zip
  • Size 5KB
  • Sample211014-ws2m5sabb2
  • SHA256 a3d502012d1cded2d5a936372a08073db9b85dd2323908f9d55d802c24e8aa20
  • MD5 SHA1 SHA512
Score
10/10
bazarloaderdropperloader

Malware Config

Extracted

Language

  • ps1

Deobfuscated
Source
URLs
  • ps1.dropper

    http://bobersok.top/333g100/index.php

Targets

    • Target
      Stolen Images Evidence.js
    • Size 19KB
    • SHA256 edb86c44b69eb1071a138ec2fd99968a18d671ecbcc6cbd7babcde7a132c1e01
    • MD5 SHA1 SHA512
    Score
    10/10
    bazarloaderdropperloader

    • Bazar Loader

      Detected loader normally used to deploy BazarBackdoor malware.

      loaderdropperbazarloader

    • Bazar/Team9 Loader payload

    • Blocklisted process makes network request

    • Loads dropped DLL

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks