Overview

overview

10

Static

static

10

f18c2a8922...eb.exe

windows7_x64

10

f18c2a8922...eb.exe

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    f18c2a8922bbe7b8f12980a46cc3548e9a0903a7294206eeb2d01f7923cdb8eb

  • Size

    1.0MB

  • Sample

    211118-tbzfcaheg6

  • MD5

    4f0ff6002a6883636aace79606463b35

  • SHA1

    54b8a004d96418010e2721fbe8bb156464b7da0f

  • SHA256

    f18c2a8922bbe7b8f12980a46cc3548e9a0903a7294206eeb2d01f7923cdb8eb

  • SHA512

    5e77ecb9fbd0264f02065f84b446284249e61ca941f46de5152fc15552691a587edf04617aa1f3e673fcaeb86d4f26658de16c88a4f2f3949dbf5b7a9a8056e9

Score
10/10
bazarloaderdropperloaderpersistence

Malware Config

Extracted

Family

bazarloader

C2

18.188.232.155

Targets

    • Target

      f18c2a8922bbe7b8f12980a46cc3548e9a0903a7294206eeb2d01f7923cdb8eb

    • Size

      1.0MB

    • MD5

      4f0ff6002a6883636aace79606463b35

    • SHA1

      54b8a004d96418010e2721fbe8bb156464b7da0f

    • SHA256

      f18c2a8922bbe7b8f12980a46cc3548e9a0903a7294206eeb2d01f7923cdb8eb

    • SHA512

      5e77ecb9fbd0264f02065f84b446284249e61ca941f46de5152fc15552691a587edf04617aa1f3e673fcaeb86d4f26658de16c88a4f2f3949dbf5b7a9a8056e9

    Score
    10/10
    bazarloaderdropperloaderpersistence

    • Bazar Loader

      Detected loader normally used to deploy BazarBackdoor malware.

      loaderdropperbazarloader

    • Bazar/Team9 Loader payload

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1
T1060

Privilege Escalation

Defense Evasion

Modify Registry

1
T1112

Credential Access

Discovery

Remote System Discovery

1
T1018

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks