Static task
static1
Behavioral task
behavioral1
Sample
6f507a0c448c1cafdf502fdb1d1e70affce420022d63c1816bec111246575936.exe
Resource
win7-20220414-en
Behavioral task
behavioral2
Sample
6f507a0c448c1cafdf502fdb1d1e70affce420022d63c1816bec111246575936.exe
Resource
win10v2004-20220414-en
General
-
Target
6f507a0c448c1cafdf502fdb1d1e70affce420022d63c1816bec111246575936
-
Size
121KB
-
MD5
57e4b93639e8719dd46caf64cbaad633
-
SHA1
2854f262b10cd323acde6bf1bd61017118abb757
-
SHA256
6f507a0c448c1cafdf502fdb1d1e70affce420022d63c1816bec111246575936
-
SHA512
a19682425d6ef78c7e834cadb3fc563e14a7785a45066c173cd6c3de89c214231662e6bcf60c87149d4d694f86c55e532194754ceda5ef63166de4b8f2003e2f
-
SSDEEP
1536:rISdZ9X4ji6rDkT+bCbsQD99UeS/x3CP5e8FCMuGK9CmIG0iFj9IGJmJfodu:rn5MysN3/M48FPvKLX9mT
Malware Config
Signatures
-
Bazar/Team9 Loader payload 1 IoCs
Processes:
resource yara_rule sample BazarLoaderVar1 -
Bazarloader family
Files
-
6f507a0c448c1cafdf502fdb1d1e70affce420022d63c1816bec111246575936.exe windows x64
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_ISOLATION
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Sections
.text Size: 116KB - Virtual size: 116KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 2KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 512B - Virtual size: 5KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ