Overview

overview

10

Static

static

7f3bcbb3e8...4f.exe

windows7_x64

10

7f3bcbb3e8...4f.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    7f3bcbb3e8080ac75f7bba326a23c54f

  • Size

    479KB

  • Sample

    220715-lp1lkaadc8

  • MD5

    7f3bcbb3e8080ac75f7bba326a23c54f

  • SHA1

    e2cf8adac9d9860db7fff35dc0d9c94807b0f2dd

  • SHA256

    3bc6fc23cef261ac74aa5b98d0c3ec9a4fb1ef3f6b850334d4df698a5fe1ec04

  • SHA512

    da60459af98161122eac4830c9017d1161d8fb6c4c6f65c0abd0e40cc536131678810943fc4c048110f0a2e7be0bff7d9de0c00589aa6f8e61fefe99a872b966

Score
10/10
bazarloaderdropperloadersuricata

Malware Config

Targets

    • Target

      7f3bcbb3e8080ac75f7bba326a23c54f

    • Size

      479KB

    • MD5

      7f3bcbb3e8080ac75f7bba326a23c54f

    • SHA1

      e2cf8adac9d9860db7fff35dc0d9c94807b0f2dd

    • SHA256

      3bc6fc23cef261ac74aa5b98d0c3ec9a4fb1ef3f6b850334d4df698a5fe1ec04

    • SHA512

      da60459af98161122eac4830c9017d1161d8fb6c4c6f65c0abd0e40cc536131678810943fc4c048110f0a2e7be0bff7d9de0c00589aa6f8e61fefe99a872b966

    Score
    10/10
    bazarloaderdropperloadersuricata

    • Bazar Loader

      Detected loader normally used to deploy BazarBackdoor malware.

      loaderdropperbazarloader

    • suricata: ET MALWARE BazaLoader Activity (GET)

      suricata: ET MALWARE BazaLoader Activity (GET)

      suricata

    • suricata: ET MALWARE Win32/BazarLoader Activity (GET)

      suricata: ET MALWARE Win32/BazarLoader Activity (GET)

      suricata

    • Bazar/Team9 Loader payload

    • Tries to connect to .bazar domain

      Attempts to lookup or connect to a .bazar domain, used by BazarBackdoor, Trickbot, and potentially others.

    • Unexpected DNS network traffic destination

      Network traffic to other servers than the configured DNS servers was detected on the DNS port.

    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks