Description
Detected loader normally used to deploy BazarBackdoor malware.
fileman.pdf
General
Target
Size
Sample
fileman.pdf
213KB
220411-dmebjsgcfj
Score
10 /10
MD5
SHA1
SHA256
SHA512
6f3be0dfe6b5971b16464b7924772445
8af5e975c00f5bdbd843f644a60adbb5f8da8a0d
b51cb6fa584a073fe95bcf8749cf84363cb431f520a5d97cec92aae88329b7cb
a1a8d49ec7610c37284a2e9f7409f1f93343c7d9c676985b9a3759388835880e7e376451e89294654cb4fc0f6c6386876896da50347c8bc4a98b80b1825cd5ef
Malware Config
Extracted
| Family | bazarloader |
| C2 |
148.163.42.213 5.255.102.10 188.127.235.177 23.160.193.221 reddew28c.bazar bluehail.bazar whitestorm9p.bazar |
Targets
Target
MD5
Filesize
fileman.pdf
6f3be0dfe6b5971b16464b7924772445
213KB
Score
10/10
SHA1
SHA256
SHA512
8af5e975c00f5bdbd843f644a60adbb5f8da8a0d
b51cb6fa584a073fe95bcf8749cf84363cb431f520a5d97cec92aae88329b7cb
a1a8d49ec7610c37284a2e9f7409f1f93343c7d9c676985b9a3759388835880e7e376451e89294654cb4fc0f6c6386876896da50347c8bc4a98b80b1825cd5ef
Tags
Signatures
-
Bazar Loader
Related Tasks
MITRE ATT&CK Matrix
Collection
Command and Control
Credential Access
Defense Evasion
Discovery
Execution
Exfiltration
Impact
Initial Access
Lateral Movement
Persistence
Privilege Escalation
Tasks