General

  • Target
    7e2a361d904e56e56ebdc4c4439e77f63246ae4276f573ad5b5427a0658fc5a3
  • Size 549KB
  • Sample220128-k2h2lsacfq
  • SHA256 826e2714199a8eba46fa1d544409c8f49805597efc19d7d1916286a1bd4eda91
  • MD5 SHA1 SHA512

Malware Config

Targets

    • Target
      7e2a361d904e56e56ebdc4c4439e77f63246ae4276f573ad5b5427a0658fc5a3
    • Size 1.7MB
    • SHA256 7e2a361d904e56e56ebdc4c4439e77f63246ae4276f573ad5b5427a0658fc5a3
    • MD5 SHA1 SHA512
    • Bazar Loader

      Detected loader normally used to deploy BazarBackdoor malware.

    • Process spawned unexpected child process

      This typically indicates the parent process was compromised via an exploit or macro.

    • Bazar/Team9 Loader payload

    • Blocklisted process makes network request

    • Loads dropped DLL

MITRE ATT&CK Enterprise v6

Tasks