Overview

overview

10

Static

static

a5f51f376a...13.exe

windows7_x64

10

a5f51f376a...13.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    a5f51f376a2c7a84ff6220a95302f777e9f234b163bcc886f88fd0c223adeb13

  • Size

    243KB

  • Sample

    220302-c3j2asdhhn

  • MD5

    6cf7f288325e1e49d6b936b8a8eaff9e

  • SHA1

    2f49f2b04147b91e20966ac82fd64f1f340854a7

  • SHA256

    a5f51f376a2c7a84ff6220a95302f777e9f234b163bcc886f88fd0c223adeb13

  • SHA512

    9152e5437dfea3117d29624929cbfce5ab2dda96838d1236e59c30b5934505a67fc136ebe2586161290d07ef90339355cab78cd6248f8d5e15abf7232d3dcdbd

Score
10/10
bazarbackdoorbazarloaderbackdoordropperloadersuricata

Malware Config

Targets

    • Target

      a5f51f376a2c7a84ff6220a95302f777e9f234b163bcc886f88fd0c223adeb13

    • Size

      243KB

    • MD5

      6cf7f288325e1e49d6b936b8a8eaff9e

    • SHA1

      2f49f2b04147b91e20966ac82fd64f1f340854a7

    • SHA256

      a5f51f376a2c7a84ff6220a95302f777e9f234b163bcc886f88fd0c223adeb13

    • SHA512

      9152e5437dfea3117d29624929cbfce5ab2dda96838d1236e59c30b5934505a67fc136ebe2586161290d07ef90339355cab78cd6248f8d5e15abf7232d3dcdbd

    Score
    10/10
    bazarbackdoorbazarloaderbackdoordropperloadersuricata

    • Bazar Loader

      Detected loader normally used to deploy BazarBackdoor malware.

      loaderdropperbazarloader

    • BazarBackdoor

      Stealthy backdoor targeting corporate networks, believed to be developed by Trickbot's authors.

      backdoorbazarbackdoor

    • suricata: ET MALWARE Possible Compromised Host AnubisNetworks Sinkhole Cookie Value Snkz

      suricata: ET MALWARE Possible Compromised Host AnubisNetworks Sinkhole Cookie Value Snkz

      suricata

    • Tries to connect to .bazar domain

      Attempts to lookup or connect to a .bazar domain, used by BazarBackdoor, Trickbot, and potentially others.

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Install Root Certificate

1
T1130

Modify Registry

1
T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks