Overview

overview

10

Static

static

Attachments.lnk

windows7_x64

10

Attachments.lnk

windows10-2004_x64

10

DumpStack.log.dll

windows7_x64

1

DumpStack.log.dll

windows10-2004_x64

1

Sharing

Copy URL Twitter E-mail

General

  • Target
    5101677762478080.zip
  • Size 116KB
  • Sample220119-tp5vaabdh3
  • SHA256 487290690d5455b475497515474f45a5daf47ca8b2e8d64155f79f7fad0bb3a8
  • MD5 SHA1 SHA512
Score
10/10
bazarloaderdropperloader

Malware Config

Targets

    • Target
      Attachments.lnk
    • Size 1KB
    • SHA256 6497223d35530f2e510382aa1866b83ffaf215213b8080b7ecb299b6e7e3e6b1
    • MD5 SHA1 SHA512
    Score
    10/10
    bazarloaderdropperloader

    • Bazar Loader

      Detected loader normally used to deploy BazarBackdoor malware.

      loaderdropperbazarloader

    • Bazar/Team9 Loader payload

    • Blocklisted process makes network request

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Loads dropped DLL

    behavioral1behavioral2
    • Target
      DumpStack.log
    • Size 216KB
    • SHA256 f2a957f609ec57b8cbc6035629b249edc288bca6025a1e1a7c83a8ce20f7ebdb
    • MD5 SHA1 SHA512
    Score
    1/10
    behavioral3behavioral4

MITRE ATT&CK Enterprise v6

Tasks