Overview

overview

10

Static

static

8

88a66e7115...67.exe

windows7-x64

10

88a66e7115...67.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    88a66e7115caa4c1e11822248a64d8a6da70934dafd382627adde693fd918767

  • Size

    42.5MB

  • Sample

    221011-c5xeeabecn

  • MD5

    f96ce21f37e356f59df71370cba4b71d

  • SHA1

    785b724a8cb34b677b7fb0b9b770b9b27b689538

  • SHA256

    88a66e7115caa4c1e11822248a64d8a6da70934dafd382627adde693fd918767

  • SHA512

    0aa3107611282198d34ecb9c3a83aa56b0d3bbf92624104195c354864bf3053c7a4f6742df419c69a3cedd3688e9c719fc8bf4bd21bb4e450d8b09967980b330

  • SSDEEP

    786432:T/n5lSOGApJPAHuXkw7/UQs2MMNixxG1cghRFbbraU3VvcMzztsIxeGX:bnGgAOXkw22sx8cEFbbGKNzz/wGX

Score
10/10
bazarbackdoorbackdoorbootkitpersistenceupx

Malware Config

Targets

    • Target

      88a66e7115caa4c1e11822248a64d8a6da70934dafd382627adde693fd918767

    • Size

      42.5MB

    • MD5

      f96ce21f37e356f59df71370cba4b71d

    • SHA1

      785b724a8cb34b677b7fb0b9b770b9b27b689538

    • SHA256

      88a66e7115caa4c1e11822248a64d8a6da70934dafd382627adde693fd918767

    • SHA512

      0aa3107611282198d34ecb9c3a83aa56b0d3bbf92624104195c354864bf3053c7a4f6742df419c69a3cedd3688e9c719fc8bf4bd21bb4e450d8b09967980b330

    • SSDEEP

      786432:T/n5lSOGApJPAHuXkw7/UQs2MMNixxG1cghRFbbraU3VvcMzztsIxeGX:bnGgAOXkw22sx8cEFbbGKNzz/wGX

    Score
    10/10
    bazarbackdoorbackdoorbootkitpersistenceupx

    • BazarBackdoor

      Stealthy backdoor targeting corporate networks, believed to be developed by Trickbot's authors.

      backdoorbazarbackdoor

    • Bazar/Team9 Backdoor payload

    • Executes dropped EXE

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Loads dropped DLL

    • Writes to the Master Boot Record (MBR)

      Bootkits write to the MBR to gain persistence at a level below the operating system.

      bootkitpersistence

    • Suspicious use of NtSetInformationThreadHideFromDebugger

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Bootkit

1
T1067

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1
T1012

System Information Discovery

2
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks