9368b2e452b648df6375818ef333bef1810b36e83db0a950515dcbb7ab34ff33

General
Target

9368b2e452b648df6375818ef333bef1810b36e83db0a950515dcbb7ab34ff33

Size

156KB

Sample

220510-wdp1ssdgg5

Score
10 /10
MD5

76b0f0d39f02744dd1937fe7688807d8

SHA1

64cfa7352be82723e11282099975635f33fe7eb5

SHA256

9368b2e452b648df6375818ef333bef1810b36e83db0a950515dcbb7ab34ff33

SHA512

b2eca7e0282f91180ab5f351e8e7eb74bea787976cadfd7e41b5b88147addef9d15cadd1a03070fa83cb18af05e17cc695d7ed3a193c665b217bd91077d04503

Malware Config
Targets
Target

9368b2e452b648df6375818ef333bef1810b36e83db0a950515dcbb7ab34ff33

MD5

76b0f0d39f02744dd1937fe7688807d8

Filesize

156KB

Score
10/10
SHA1

64cfa7352be82723e11282099975635f33fe7eb5

SHA256

9368b2e452b648df6375818ef333bef1810b36e83db0a950515dcbb7ab34ff33

SHA512

b2eca7e0282f91180ab5f351e8e7eb74bea787976cadfd7e41b5b88147addef9d15cadd1a03070fa83cb18af05e17cc695d7ed3a193c665b217bd91077d04503

Tags

Signatures

  • Bazar Loader

    Description

    Detected loader normally used to deploy BazarBackdoor malware.

    Tags

  • Tries to connect to .bazar domain

    Description

    Attempts to lookup or connect to a .bazar domain, used by BazarBackdoor, Trickbot, and potentially others.

Related Tasks

MITRE ATT&CK Matrix
Collection
    Command and Control
      Credential Access
        Defense Evasion
          Discovery
            Execution
              Exfiltration
                Impact
                  Initial Access
                    Lateral Movement
                      Persistence
                        Privilege Escalation
                          Tasks

                          static1

                          behavioral1

                          10/10

                          behavioral2

                          10/10