Static task
static1
Behavioral task
behavioral1
Sample
58880777c4b2d9d1ac7cd145c6704a936a54510eaaa7ae61ce8ca8390e355006.exe
Resource
win7-en-20211208
Behavioral task
behavioral2
Sample
58880777c4b2d9d1ac7cd145c6704a936a54510eaaa7ae61ce8ca8390e355006.exe
Resource
win10v2004-en-20220113
General
-
Target
58880777c4b2d9d1ac7cd145c6704a936a54510eaaa7ae61ce8ca8390e355006
-
Size
228KB
-
MD5
e16a92cccc3700196337c9ad43210f38
-
SHA1
68d8e4654662c4e83c4c101e70eb132a1d879e0e
-
SHA256
58880777c4b2d9d1ac7cd145c6704a936a54510eaaa7ae61ce8ca8390e355006
-
SHA512
1823db3d4da397932827e455f8092a41aeb65690ffcc31e6f9afabb35e6741a96ff6229c771d6cbe2505d789617d10608aef86d5e6950d5cdf29e65826d4aa16
-
SSDEEP
6144:aMjYlrdBoHRDl02h/1uO5/hlK7wDQhqJYax:aMjUdBoHRD/lg4/PlDEiYa
Malware Config
Signatures
-
Bazar/Team9 Backdoor payload 1 IoCs
Processes:
resource yara_rule sample BazarBackdoorVar3 -
Bazarbackdoor family
Files
-
58880777c4b2d9d1ac7cd145c6704a936a54510eaaa7ae61ce8ca8390e355006.exe windows x64
a79e5f31c5a0fc2af224859bc798bc32
Code Sign
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_ISOLATION
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
kernel32
HeapSize
GetProcessHeap
GetTickCount
WriteConsoleW
HeapFree
GetConsoleCP
FlushFileBuffers
HeapReAlloc
HeapAlloc
VirtualQuery
VirtualFree
WideCharToMultiByte
DeleteCriticalSection
GetConsoleMode
InitializeCriticalSectionAndSpinCount
GetLastError
RaiseException
SetFilePointerEx
SetStdHandle
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
IsDebuggerPresent
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetStartupInfoW
IsProcessorFeaturePresent
GetModuleHandleW
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
OutputDebugStringW
EnterCriticalSection
LeaveCriticalSection
RtlUnwindEx
SetLastError
EncodePointer
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
FreeLibrary
GetProcAddress
LoadLibraryExW
RtlPcToFileHeader
GetCurrentProcess
ExitProcess
TerminateProcess
GetModuleHandleExW
GetModuleFileNameA
MultiByteToWideChar
GetStdHandle
WriteFile
GetACP
GetStringTypeW
GetFileType
LCMapStringW
FindClose
FindFirstFileExA
FindNextFileA
IsValidCodePage
GetOEMCP
GetCPInfo
GetCommandLineA
GetCommandLineW
GetEnvironmentStringsW
FreeEnvironmentStringsW
CloseHandle
CreateFileW
user32
RegisterClassExA
advapi32
CryptGetUserKey
CryptReleaseContext
CryptGenKey
CryptDestroyKey
CryptAcquireContextW
oleaut32
VariantClear
VariantInit
crypt32
CertSetCertificateContextProperty
CertStrToNameA
CertCreateSelfSignCertificate
CertFreeCertificateContext
secur32
InitSecurityInterfaceA
Sections
.text Size: 144KB - Virtual size: 140KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 48KB - Virtual size: 46KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 16KB - Virtual size: 14KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 8KB - Virtual size: 6KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 4KB - Virtual size: 16B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ