Static task
static1
Behavioral task
behavioral1
Sample
f351b6bef91b600954f23402eddc68deb0e2e2d3b6099a7250bc54ba3a2aff3e.exe
Resource
win7-20220331-en
Behavioral task
behavioral2
Sample
f351b6bef91b600954f23402eddc68deb0e2e2d3b6099a7250bc54ba3a2aff3e.exe
Resource
win10v2004-en-20220113
General
-
Target
f351b6bef91b600954f23402eddc68deb0e2e2d3b6099a7250bc54ba3a2aff3e
-
Size
231KB
-
MD5
ebba0a18ecb946c45f60a14be223c7d4
-
SHA1
cfbb5280e97aa589c3fa46ae2bc77c9523eba46a
-
SHA256
f351b6bef91b600954f23402eddc68deb0e2e2d3b6099a7250bc54ba3a2aff3e
-
SHA512
71dea8c205883df79b154c1586e4be0fa9b784ae6d47a8718f9b09cc4b803e26b20f5ebc396376dfc1848a2e261e805b84c2d70ee1a8ccd5a234141715850f4a
Malware Config
Signatures
-
Bazar/Team9 Loader payload 1 IoCs
Processes:
resource yara_rule sample BazarLoaderVar1 -
Bazarloader family
Files
-
f351b6bef91b600954f23402eddc68deb0e2e2d3b6099a7250bc54ba3a2aff3e.exe windows x64
Code Sign
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_ISOLATION
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Sections
.text Size: 111KB - Virtual size: 111KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 2KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.jvuoru Size: 512B - Virtual size: 5KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 108KB - Virtual size: 108KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE