Overview

overview

10

Static

static

Documents.lnk

windows7_x64

10

Documents.lnk

windows10_x64

10

Documents.tmp.dll

windows7_x64

10

Documents.tmp.dll

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    Documents-report-21.iso

  • Size

    776KB

  • Sample

    211020-wjky2ahdf9

  • MD5

    ed70c9a9168a3b6f7ac56ae48e60b583

  • SHA1

    8436bfcb10c9c70f789f6db9acf77ec4e550af74

  • SHA256

    29fc04ad420d5b64e7f420c6d9b4f86b9ee4e36483538d4e3b1835950baca760

  • SHA512

    00529b2d91e54621879a8a4606ee3aac1128596f6a2296a651dc16e98429bb2228318c25de5ac1859d17c9f996dd4a266dae7048c5b22b4b6e744a0e084e5546

Score
10/10
bazarloaderdropperloader

Malware Config

Targets

    • Target

      Documents.lnk

    • Size

      1KB

    • MD5

      857402be70e2963aebaed2162585dfed

    • SHA1

      de55e131a8e20331f170aa6cdaca522bcf549f29

    • SHA256

      d982cd19473751d5d32f749e198e42d4cae2548eae65b532d0d121a275f62b8f

    • SHA512

      f61f8670c035f9a3d3de25a6b15abd0b974debb721338c7bbf1fd38734f6c02a121d87a0ec6caa29992a66d19da28ff07667f0e8ffb19fdc1e5f8c467e9ca7e9

    Score
    10/10
    bazarloaderdropperloader

    • Bazar Loader

      Detected loader normally used to deploy BazarBackdoor malware.

      loaderdropperbazarloader

    • Bazar/Team9 Loader payload

    • Blocklisted process makes network request

    • Deletes itself

    • Loads dropped DLL

    behavioral1behavioral2

    • Target

      Documents.tmp

    • Size

      724KB

    • MD5

      d7e7cf2ed643c84f35da54f6abbc8409

    • SHA1

      4eaff70353abf1a9d1caf840d7a23c3f72fc5bb6

    • SHA256

      4374f12287c158cc6e9421640b459455307e471711cc41f5666a1cbc553a3eb3

    • SHA512

      cdf21fdcece645df88392bb9a0a865cb6ff5180d25bdeffab3a781c58612c84e0b2de1cbca8dacbfd307e3afcaf1fb5f60527f572c6b6098a43defc142799b21

    Score
    10/10
    bazarloaderdropperloader

    • Bazar Loader

      Detected loader normally used to deploy BazarBackdoor malware.

      loaderdropperbazarloader

    • Bazar/Team9 Loader payload

    • Blocklisted process makes network request

    behavioral3behavioral4

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks