Overview

overview

10

Static

static

059519e037...f4.exe

windows7_x64

10

059519e037...f4.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    059519e03772d6eeea9498625ae8b8b7cf2f01fc8179ca5d33d6bcf29d07c9f4

  • Size

    216KB

  • Sample

    220219-klzdnaaab6

  • MD5

    41ba0038d1edc5f2e2c001af2807cb10

  • SHA1

    0d47fc9dd5f4f0728c65e283781a012f27fe2d84

  • SHA256

    059519e03772d6eeea9498625ae8b8b7cf2f01fc8179ca5d33d6bcf29d07c9f4

  • SHA512

    308add3de2ac5acf244b6cdd2dffc3226ee68e9a1de85a69c73ce5e720d187e462036a4d994da00efeb40ef6d62fe3af7094cea73a84f1115b6d0094db77c62d

Score
10/10
bazarbackdoorbazarloaderbackdoordropperloader

Malware Config

Targets

    • Target

      059519e03772d6eeea9498625ae8b8b7cf2f01fc8179ca5d33d6bcf29d07c9f4

    • Size

      216KB

    • MD5

      41ba0038d1edc5f2e2c001af2807cb10

    • SHA1

      0d47fc9dd5f4f0728c65e283781a012f27fe2d84

    • SHA256

      059519e03772d6eeea9498625ae8b8b7cf2f01fc8179ca5d33d6bcf29d07c9f4

    • SHA512

      308add3de2ac5acf244b6cdd2dffc3226ee68e9a1de85a69c73ce5e720d187e462036a4d994da00efeb40ef6d62fe3af7094cea73a84f1115b6d0094db77c62d

    Score
    10/10
    bazarbackdoorbazarloaderbackdoordropperloader

    • Bazar Loader

      Detected loader normally used to deploy BazarBackdoor malware.

      loaderdropperbazarloader

    • BazarBackdoor

      Stealthy backdoor targeting corporate networks, believed to be developed by Trickbot's authors.

      backdoorbazarbackdoor

    • Tries to connect to .bazar domain

      Attempts to lookup or connect to a .bazar domain, used by BazarBackdoor, Trickbot, and potentially others.

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks