bazarloader | 94f10ed1d1bdc071cebe863023d6e68d8460e2ff8cbd3f115ff7a63b58ea7d27

Sharing

Copy URL Twitter E-mail

General

Target
520c323cbbd3e2c3daeb7b9fe75d2739.exe
Size 201KB
Sample211106-qph4qsbfgm
SHA256 94f10ed1d1bdc071cebe863023d6e68d8460e2ff8cbd3f115ff7a63b58ea7d27
MD5 520c323cbbd3e2c3daeb7b9fe75d2739
SHA1 a685d6ab40415745c9c6dfb0b5c34a4a88af488b
SHA512 a57964a9f18ae21668d4a89b7e081d06e6c7055408199b9de5d35524b5fe2d8c59e3f33ab16a0829861c3256f6761406788b21df799d7b4317f5f15d1a73ec15
MD5 SHA1 SHA512

Malware Config

Extracted

Family

smokeloader

Version

2020

http://hefahei60.top/
http://pipevai40.top/
http://nusurtal4f.net/
http://netomishnetojuk.net/
http://escalivrouter.net/
http://nick22doom4.net/
http://wrioshtivsio.su/
http://nusotiso4.su/
http://rickkhtovkka.biz/
http://palisotoliso.net/

rc4.i32

Extracted

Family

tofsee

quadoil.ru
lakeflex.ru

Extracted

Family

redline

Botnet

23435346346

93.115.20.139:28978

Extracted

Family

redline

Botnet

SuperStar

185.215.113.29:36224

Extracted

Family

redline

Botnet

185.92.73.142:52097

Extracted

Family

raccoon

Botnet

1cb6d1b7211b77f96ff654c9904c9c8522f8a677

Attributes

url4cnc
http://teleliver.top/hiioBlacklight1

http://livetelive.top/hiioBlacklight1

http://teleger.top/hiioBlacklight1

http://telestrong.top/hiioBlacklight1

http://tgrampro.top/hiioBlacklight1

http://teleghost.top/hiioBlacklight1

http://teleroom.top/hiioBlacklight1

http://telemir.top/hiioBlacklight1

http://teletelo.top/hiioBlacklight1

https://t.me/hiioBlacklight1

rc4.plain

Extracted

Family

raccoon

Botnet

8dec62c1db2959619dca43e02fa46ad7bd606400

Attributes

url4cnc
http://telegin.top/capibar

http://ttmirror.top/capibar

http://teletele.top/capibar

http://telegalive.top/capibar

http://toptelete.top/capibar

http://telegraf.top/capibar

https://t.me/capibar

rc4.plain

Extracted

Family

raccoon

Version

1.8.3

Botnet

243f5e3056753d9f9706258dce4f79e57c3a9c44

Attributes

url4cnc
http://178.23.190.57/agrybirdsgamerept

http://91.219.236.162/agrybirdsgamerept

http://185.163.47.176/agrybirdsgamerept

http://193.38.54.238/agrybirdsgamerept

http://74.119.192.122/agrybirdsgamerept

http://91.219.236.240/agrybirdsgamerept

rc4.plain

Extracted

Family

djvu

http://pqkl.org/lancer/get.php

Attributes

extension
.irfk
offline_id
7HKlLI6NrOQGMaTs5PqjvV1UcZ3VOcIeyFiH3Wt1
payload_url
http://kotob.top/dl/build2.exe

http://pqkl.org/files/1/build3.exe
ransomnote
ATTENTION! Don't worry, you can return all your files! All your files like pictures, databases, documents and other important are encrypted with strongest encryption and unique key. The only method of recovering files is to purchase decrypt tool and unique key for you. This software will decrypt all your encrypted files. What guarantees you have? You can send one of your encrypted file from your PC and we decrypt it for free. But we can decrypt only 1 file for free. File must not contain valuable information. You can get and look video overview decrypt tool: https://we.tl/t-dFmA3YqXzs Price of private key and decrypt software is $980. Discount 50% available if you contact us first 72 hours, that's price for you is $490. Please note that you'll never restore your data without payment. Check your e-mail "Spam" or "Junk" folder if you don't get answer more than 6 hours. To get this software you need write on our e-mail: [email protected] Reserve e-mail address to contact us: [email protected] Your personal ID: 0346uSifke

rsa_pubkey.plain

Extracted

Family

redline

Botnet

z0rm1on

45.153.186.153:56675

Extracted

Family

vidar

Version

47.9

Botnet

https://mas.to/@kirpich

Attributes

profile_id
706

Targets

- Target
  520c323cbbd3e2c3daeb7b9fe75d2739.exe
- Size 201KB
- SHA256 94f10ed1d1bdc071cebe863023d6e68d8460e2ff8cbd3f115ff7a63b58ea7d27
- MD5 520c323cbbd3e2c3daeb7b9fe75d2739
- SHA1 a685d6ab40415745c9c6dfb0b5c34a4a88af488b
- SHA512 a57964a9f18ae21668d4a89b7e081d06e6c7055408199b9de5d35524b5fe2d8c59e3f33ab16a0829861c3256f6761406788b21df799d7b4317f5f15d1a73ec15
- MD5 SHA1 SHA512
Score

10^/10

redline smokeloader tofsee xmrig 23435346346 backdoor evasion infostealer miner persistence trojan bazarloader djvu raccoon vidar 101 1cb6d1b7211b77f96ff654c9904c9c8522f8a677 243f5e3056753d9f9706258dce4f79e57c3a9c44 706 8dec62c1db2959619dca43e02fa46ad7bd606400 superstar z0rm1on discovery dropper loader ransomware spyware stealer suricata
- Bazar Loader
  Detected loader normally used to deploy BazarBackdoor malware.
  loader dropper bazarloader
- Detected Djvu ransomware
- Djvu Ransomware
  Ransomware which is a variant of the STOP family.
  ransomware djvu
- Raccoon
  Simple but powerful infostealer which was very active in 2019.
  stealer raccoon
- RedLine
  RedLine Stealer is a malware family written in C#, first appearing in early 2020.
  infostealer redline
- RedLine Payload
- SmokeLoader
  Modular backdoor trojan in use since 2014.
  trojan backdoor smokeloader
- Suspicious use of NtCreateProcessExOtherParentProcess
- Tofsee
  Backdoor/botnet which carries out malicious activities based on commands from a C2 server.
  trojan tofsee
- Vidar
  Vidar is an infostealer based on Arkei stealer.
  stealer vidar
- Windows security bypass
  evasion trojan
- suricata: ET MALWARE Known Sinkhole Response Header
  suricata: ET MALWARE Known Sinkhole Response Header
  suricata
- suricata: ET MALWARE Potential Dridex.Maldoc Minimal Executable Request
  suricata: ET MALWARE Potential Dridex.Maldoc Minimal Executable Request
  suricata
- xmrig
  XMRig is a high performance, open source, cross platform CPU/GPU miner.
  miner xmrig
- Bazar/Team9 Loader payload
- Core1 .NET packer
  Detects packer/loader used by .NET malware.
- Vidar Stealer
  stealer
- XMRig Miner Payload
  miner
- Creates new service(s)
  persistence
- Downloads MZ/PE file
- Executes dropped EXE
- Modifies Windows Firewall
  evasion
- Sets service image path in registry
  persistence
- Deletes itself
- Loads dropped DLL
- Modifies file permissions
  discovery
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Accesses cryptocurrency files/wallets, possible credential harvesting
  spyware
- Adds Run key to start application
  persistence
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- Drops file in System32 directory
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Modify Existing Service

T1031

New Service

T1050

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

New Service

T1050

Defense Evasion

Disabling Security Tools

T1089

File and Directory Permissions Modification

T1222

Install Root Certificate

T1130

Modify Registry

T1112

Credential Access

Credentials in Files

T1081

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Targets

Bazar Loader

Detected Djvu ransomware

Djvu Ransomware

Raccoon

RedLine

RedLine Payload

SmokeLoader

Suspicious use of NtCreateProcessExOtherParentProcess

Tofsee

Vidar

Windows security bypass

suricata: ET MALWARE Known Sinkhole Response Header

suricata: ET MALWARE Potential Dridex.Maldoc Minimal Executable Request

xmrig

Bazar/Team9 Loader payload

Core1 .NET packer

Vidar Stealer

XMRig Miner Payload

Creates new service(s)

Downloads MZ/PE file

Executes dropped EXE

Modifies Windows Firewall

Sets service image path in registry

Deletes itself

Loads dropped DLL

Modifies file permissions

Reads user/profile data of web browsers

Accesses cryptocurrency files/wallets, possible credential harvesting

Adds Run key to start application

Checks installed software on the system

Looks up external IP address via web service

Drops file in System32 directory

Suspicious use of NtSetInformationThreadHideFromDebugger

Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v6

Tasks

static1

behavioral1

behavioral2