fd47e20c094a1e23079eee41440b971162c1df668315b5e882c12805b9ec0c68

General
Target

fd47e20c094a1e23079eee41440b971162c1df668315b5e882c12805b9ec0c68

Size

250KB

Sample

220508-2nhmcshfe8

Score
10 /10
MD5

b8dd3183755b57f5e18f29a0430b481e

SHA1

42485407433474d4fd2b6880eef4b49fa6c277d9

SHA256

fd47e20c094a1e23079eee41440b971162c1df668315b5e882c12805b9ec0c68

SHA512

8362fa5a3c3563b470ba06b49cfb662b7e114d77481bf656af3a1e71666ef26ad8d758776f075fe9c0634456f5c0b4a360016a75a3967b766cde8ab0449f5d31

Malware Config
Targets
Target

fd47e20c094a1e23079eee41440b971162c1df668315b5e882c12805b9ec0c68

MD5

b8dd3183755b57f5e18f29a0430b481e

Filesize

250KB

Score
10/10
SHA1

42485407433474d4fd2b6880eef4b49fa6c277d9

SHA256

fd47e20c094a1e23079eee41440b971162c1df668315b5e882c12805b9ec0c68

SHA512

8362fa5a3c3563b470ba06b49cfb662b7e114d77481bf656af3a1e71666ef26ad8d758776f075fe9c0634456f5c0b4a360016a75a3967b766cde8ab0449f5d31

Tags

Signatures

  • Bazar Loader

    Description

    Detected loader normally used to deploy BazarBackdoor malware.

    Tags

  • Tries to connect to .bazar domain

    Description

    Attempts to lookup or connect to a .bazar domain, used by BazarBackdoor, Trickbot, and potentially others.

Related Tasks

MITRE ATT&CK Matrix
Collection
    Command and Control
      Credential Access
        Defense Evasion
          Discovery
            Execution
              Exfiltration
                Impact
                  Initial Access
                    Lateral Movement
                      Persistence
                        Privilege Escalation
                          Tasks

                          static1

                          behavioral1

                          10/10

                          behavioral2

                          10/10