Extracted

• • Target
    b86125097a79fa65922b0161fcd1f2c6f4fb70237b3074746eceabf8f799b253.xll
  • Size 1.3MB
  • SHA256 b86125097a79fa65922b0161fcd1f2c6f4fb70237b3074746eceabf8f799b253
  • MD5 06e70aab2069b7c471f4cd3d70ba3829
  • SHA1 2f0963a785963e3c78c8b5eee742caf1d0368db0
  • SHA512 4900628e39e7a704898ec90fd99ca92c23796cebff52d7bab3fb207f59fd9b992f33999f644196e6519bcfdd9222a4dd2b34974f968c1193a32725ccd95b56d7
  • MD5 SHA1 SHA512

  Score

  10^/10

  bazarloaderdropperloaderpersistence

  • Bazar Loader

    Detected loader normally used to deploy BazarBackdoor malware.

    loaderdropperbazarloader

  • Process spawned unexpected child process

    This typically indicates the parent process was compromised via an exploit or macro.

  • Bazar/Team9 Loader payload

  • Blocklisted process makes network request

  • Sets service image path in registry

    persistence

  • Loads dropped DLL

  behavioral1behavioral2