bazarloader | 0850e7daf8a13b13aeb3d48bf41303856735c01e2b4d97819222c9b8c700aebe | Triage

Sharing

General

Target

0850e7daf8a13b13aeb3d48bf41303856735c01e2b4d97819222c9b8c700aebe
Size

213KB
Sample

211208-qnjc4saegq
MD5

a251ed6c078614e663e4ada306429782
SHA1

3cf498e32d901ab24b9ba927c0c92c80c9377687
SHA256

0850e7daf8a13b13aeb3d48bf41303856735c01e2b4d97819222c9b8c700aebe
SHA512

46b1fd352ebdb96c5e187c9c9127ebaeb3037dae978a18b69396cb4e766ca0a0178be0aa6559bdd85ab97681f23fdbbea1868d3a9c17c8461a57903106630be3

Score

10^/10

bazarloader raccoon smokeloader f797145799b7b1b77b35d81de942eee0908da519 fd4f23250443a724a3d1548e6ab07c481dfc2814 backdoor dropper loader stealer suricata trojan

Malware Config

Extracted

Family

smokeloader

Version

2020

C2

http://host-data-coin-11.com/

http://file-coin-host-12.com/

rc4.i32

rc4.i32

Extracted

Family

raccoon

Version

1.8.3-hotfix

Botnet

f797145799b7b1b77b35d81de942eee0908da519

Attributes

url4cnc
http://91.219.236.27/capibar
http://94.158.245.167/capibar
http://185.163.204.216/capibar
http://185.225.19.238/capibar
http://185.163.204.218/capibar
https://t.me/capibar

rc4.plain

rc4.plain

Extracted

Family

raccoon

Version

1.8.3-hotfix

Botnet

fd4f23250443a724a3d1548e6ab07c481dfc2814

Attributes

url4cnc
http://91.219.236.27/duglassa1
http://94.158.245.167/duglassa1
http://185.163.204.216/duglassa1
http://185.225.19.238/duglassa1
http://185.163.204.218/duglassa1
https://t.me/duglassa1

rc4.plain

rc4.plain

Targets

- Target
  
  0850e7daf8a13b13aeb3d48bf41303856735c01e2b4d97819222c9b8c700aebe
- Size
  
  213KB
- MD5
  
  a251ed6c078614e663e4ada306429782
- SHA1
  
  3cf498e32d901ab24b9ba927c0c92c80c9377687
- SHA256
  
  0850e7daf8a13b13aeb3d48bf41303856735c01e2b4d97819222c9b8c700aebe
- SHA512
  
  46b1fd352ebdb96c5e187c9c9127ebaeb3037dae978a18b69396cb4e766ca0a0178be0aa6559bdd85ab97681f23fdbbea1868d3a9c17c8461a57903106630be3
Score

10^/10

bazarloader raccoon smokeloader f797145799b7b1b77b35d81de942eee0908da519 fd4f23250443a724a3d1548e6ab07c481dfc2814 backdoor dropper loader stealer suricata trojan
- Bazar Loader
  Detected loader normally used to deploy BazarBackdoor malware.
  loader dropper bazarloader
- Raccoon
  Simple but powerful infostealer which was very active in 2019.
  stealer raccoon
- SmokeLoader
  Modular backdoor trojan in use since 2014.
  trojan backdoor smokeloader
- suricata: ET MALWARE Sharik/Smoke CnC Beacon 11
  suricata: ET MALWARE Sharik/Smoke CnC Beacon 11
  suricata
- Bazar/Team9 Loader payload
- Downloads MZ/PE file
- Executes dropped EXE
- Deletes itself
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
behavioral1

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

Peripheral Device Discovery

System Information Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks

static1

behavioral1

bazarloaderraccoonsmokeloaderf797145799b7b1b77b35d81de942eee0908da519fd4f23250443a724a3d1548e6ab07c481dfc2814backdoordropperloaderstealersuricatatrojan