Overview

overview

10

Static

static

picture.dll

windows7_x64

10

picture.dll

windows10-2004_x64

10

Resubmissions

01-02-2022 01:10

220201-bjlkcafba8 10

01-02-2022 00:22

220201-anxmqsefa6 10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    picture.jpg

  • Size

    308KB

  • Sample

    220201-anxmqsefa6

  • MD5

    21c62adba10a2f518357106947a3410c

  • SHA1

    607df191b24b5bc402bf4b37272c855c8ebb9dff

  • SHA256

    716f2ae73525362939d52104e809ea9da5e031f9d31f0b53d8de77df989c8b85

  • SHA512

    049c14038e81afa17759a27456207a39f18c08b2a65a56d786dcb458ae9544b1f061f408b07c1d614ddb9baf0fa0c20115e822095446c208016b9dfef243bdde

Score
10/10
bazarloaderdropperloaderpersistence

Malware Config

Targets

    • Target

      picture.jpg

    • Size

      308KB

    • MD5

      21c62adba10a2f518357106947a3410c

    • SHA1

      607df191b24b5bc402bf4b37272c855c8ebb9dff

    • SHA256

      716f2ae73525362939d52104e809ea9da5e031f9d31f0b53d8de77df989c8b85

    • SHA512

      049c14038e81afa17759a27456207a39f18c08b2a65a56d786dcb458ae9544b1f061f408b07c1d614ddb9baf0fa0c20115e822095446c208016b9dfef243bdde

    Score
    10/10
    bazarloaderdropperloaderpersistence

    • Bazar Loader

      Detected loader normally used to deploy BazarBackdoor malware.

      loaderdropperbazarloader

    • Bazar/Team9 Loader payload

    • Blocklisted process makes network request

    • Sets service image path in registry

      persistence
    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1
T1060

Privilege Escalation

Defense Evasion

Modify Registry

1
T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks