bazarloader | 0bba9929099245665a912ee9dbf199a49aa593e29c83e61c046ef3cf2b11dec7 | Triage

Sharing

General

Target

0bba9929099245665a912ee9dbf199a49aa593e29c83e61c046ef3cf2b11dec7
Size

241KB
Sample

211208-qargkadbh7
MD5

4de86d0bc1875db66ea143fc38c110e0
SHA1

2d2ab543f8f709e624dd11fd984264b4a06d4819
SHA256

0bba9929099245665a912ee9dbf199a49aa593e29c83e61c046ef3cf2b11dec7
SHA512

a0b824a029959200166d00cc3162b8d457a351af45e2d5df5ef0f66753c06668c3805f01cd8b14e0e030706e047d201cac0761c38c80b00a08c7223cfad38275

Score

10^/10

bazarloader raccoon smokeloader f797145799b7b1b77b35d81de942eee0908da519 fd4f23250443a724a3d1548e6ab07c481dfc2814 backdoor dropper loader stealer trojan

Malware Config

Extracted

Family

smokeloader

Version

2020

C2

http://host-data-coin-11.com/

http://file-coin-host-12.com/

rc4.i32

rc4.i32

Extracted

Family

raccoon

Version

1.8.3-hotfix

Botnet

f797145799b7b1b77b35d81de942eee0908da519

Attributes

url4cnc
http://91.219.236.27/capibar
http://94.158.245.167/capibar
http://185.163.204.216/capibar
http://185.225.19.238/capibar
http://185.163.204.218/capibar
https://t.me/capibar

rc4.plain

rc4.plain

Extracted

Family

raccoon

Version

1.8.3-hotfix

Botnet

fd4f23250443a724a3d1548e6ab07c481dfc2814

Attributes

url4cnc
http://91.219.236.27/duglassa1
http://94.158.245.167/duglassa1
http://185.163.204.216/duglassa1
http://185.225.19.238/duglassa1
http://185.163.204.218/duglassa1
https://t.me/duglassa1

rc4.plain

rc4.plain

Targets

- Target
  
  0bba9929099245665a912ee9dbf199a49aa593e29c83e61c046ef3cf2b11dec7
- Size
  
  241KB
- MD5
  
  4de86d0bc1875db66ea143fc38c110e0
- SHA1
  
  2d2ab543f8f709e624dd11fd984264b4a06d4819
- SHA256
  
  0bba9929099245665a912ee9dbf199a49aa593e29c83e61c046ef3cf2b11dec7
- SHA512
  
  a0b824a029959200166d00cc3162b8d457a351af45e2d5df5ef0f66753c06668c3805f01cd8b14e0e030706e047d201cac0761c38c80b00a08c7223cfad38275
Score

10^/10

bazarloader raccoon smokeloader f797145799b7b1b77b35d81de942eee0908da519 fd4f23250443a724a3d1548e6ab07c481dfc2814 backdoor dropper loader stealer trojan
- Bazar Loader
  Detected loader normally used to deploy BazarBackdoor malware.
  loader dropper bazarloader
- Raccoon
  Simple but powerful infostealer which was very active in 2019.
  stealer raccoon
- SmokeLoader
  Modular backdoor trojan in use since 2014.
  trojan backdoor smokeloader
- Bazar/Team9 Loader payload
- Downloads MZ/PE file
- Executes dropped EXE
- Deletes itself
- Loads dropped DLL
- Suspicious use of SetThreadContext
behavioral1

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

Peripheral Device Discovery

System Information Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks

static1

behavioral1

bazarloaderraccoonsmokeloaderf797145799b7b1b77b35d81de942eee0908da519fd4f23250443a724a3d1548e6ab07c481dfc2814backdoordropperloaderstealertrojan