General

  • Target

    fd47e20c094a1e23079eee41440b971162c1df668315b5e882c12805b9ec0c68

  • Size

    250KB

  • Sample

    220508-2nhmcshfe8

  • MD5

    b8dd3183755b57f5e18f29a0430b481e

  • SHA1

    42485407433474d4fd2b6880eef4b49fa6c277d9

  • SHA256

    fd47e20c094a1e23079eee41440b971162c1df668315b5e882c12805b9ec0c68

  • SHA512

    8362fa5a3c3563b470ba06b49cfb662b7e114d77481bf656af3a1e71666ef26ad8d758776f075fe9c0634456f5c0b4a360016a75a3967b766cde8ab0449f5d31

Malware Config

Targets

    • Target

      fd47e20c094a1e23079eee41440b971162c1df668315b5e882c12805b9ec0c68

    • Size

      250KB

    • MD5

      b8dd3183755b57f5e18f29a0430b481e

    • SHA1

      42485407433474d4fd2b6880eef4b49fa6c277d9

    • SHA256

      fd47e20c094a1e23079eee41440b971162c1df668315b5e882c12805b9ec0c68

    • SHA512

      8362fa5a3c3563b470ba06b49cfb662b7e114d77481bf656af3a1e71666ef26ad8d758776f075fe9c0634456f5c0b4a360016a75a3967b766cde8ab0449f5d31

    • Bazar Loader

      Detected loader normally used to deploy BazarBackdoor malware.

    • Tries to connect to .bazar domain

      Attempts to lookup or connect to a .bazar domain, used by BazarBackdoor, Trickbot, and potentially others.

MITRE ATT&CK Matrix

Tasks