Extracted

• • Target

    2022-2-4-2ac627c145f9c76d3052d8d82db8fa21.bin

  • Size

    142KB

  • MD5

    2ac627c145f9c76d3052d8d82db8fa21

  • SHA1

    623b905cf7c268147bc29ce4715fb98a3b58e7d7

  • SHA256

    8081638587d1ad2cb3e79705c8c370b5be3b0b8b4faaf0e9271714f90eb4370d

  • SHA512

    12d07b1946f3eccad7a59d55cd3d3c2a9802fddd62c7f6db272d51c31e62624f28e9d8d2170a6e7724ac67a7bfc2ecfc2b1f5469bf0546a9eca122f58130196e

  Score

  10^/10

  bazarbackdoorbackdoorpersistence

  • BazarBackdoor

    Stealthy backdoor targeting corporate networks, believed to be developed by Trickbot's authors.

    backdoorbazarbackdoor

  • Process spawned unexpected child process

    This typically indicates the parent process was compromised via an exploit or macro.

  • Bazar/Team9 Backdoor payload

  • Sets service image path in registry

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  behavioral1behavioral2