Overview

overview

10

Static

static

70f35da615...d8.dll

windows7_x64

10

70f35da615...d8.dll

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    70f35da61529c48234793cd0eeb25715ead9c3d8.dll

  • Size

    601KB

  • Sample

    211026-nnwx4ahcd5

  • MD5

    398bc67b1475d56dccb8b48f53f1e467

  • SHA1

    70f35da61529c48234793cd0eeb25715ead9c3d8

  • SHA256

    9f433ac837309fecdd3ea85574d49350aa304d383560bb4f80654d18f64151d3

  • SHA512

    6468ff6775e730d392087ec730920f8d097afa5a2400f513c4a68d5190ca15c15dd78503047478408a3de01d3b4d3186d1c7da2ea70c043d85ca76032a39ee63

Score
10/10
bazarloaderdropperloader

Malware Config

Targets

    • Target

      70f35da61529c48234793cd0eeb25715ead9c3d8.dll

    • Size

      601KB

    • MD5

      398bc67b1475d56dccb8b48f53f1e467

    • SHA1

      70f35da61529c48234793cd0eeb25715ead9c3d8

    • SHA256

      9f433ac837309fecdd3ea85574d49350aa304d383560bb4f80654d18f64151d3

    • SHA512

      6468ff6775e730d392087ec730920f8d097afa5a2400f513c4a68d5190ca15c15dd78503047478408a3de01d3b4d3186d1c7da2ea70c043d85ca76032a39ee63

    Score
    10/10
    bazarloaderdropperloader

    • Bazar Loader

      Detected loader normally used to deploy BazarBackdoor malware.

      loaderdropperbazarloader

    • Suspicious use of NtCreateUserProcessOtherParentProcess

    • Bazar/Team9 Loader payload

    • Blocklisted process makes network request

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks