Resubmissions

22-03-2022 13:33

220322-qty1rafff4 10

22-03-2022 13:14

220322-qgt62afdf9 10

General

  • Target

    https://www.avast.com/sig-email?utm_medium=email&utm_source=link&utm_campaign=sig-email&utm_content=emailclient&utm_term=link

  • Sample

    220322-qgt62afdf9

Malware Config

Targets

    • Target

      https://www.avast.com/sig-email?utm_medium=email&utm_source=link&utm_campaign=sig-email&utm_content=emailclient&utm_term=link

    • BazarBackdoor

      Stealthy backdoor targeting corporate networks, believed to be developed by Trickbot's authors.

    • Bazar/Team9 Backdoor payload

    • Downloads MZ/PE file

    • Executes dropped EXE

    • Loads dropped DLL

    • Checks for any installed AV software in registry

    • Writes to the Master Boot Record (MBR)

      Bootkits write to the MBR to gain persistence at a level below the operating system.

MITRE ATT&CK Matrix ATT&CK v6

Persistence

Bootkit

1
T1067

Defense Evasion

Modify Registry

2
T1112

Discovery

Security Software Discovery

1
T1063

Query Registry

1
T1012

System Information Discovery

1
T1082

Tasks