Overview

overview

10

Static

static

1a19ad7360...0b.exe

windows7-x64

10

1a19ad7360...0b.exe

windows10-2004-x64

10

1a19ad7360...ed.exe

windows7-x64

10

1a19ad7360...ed.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    1a19ad73601c5636654ea6b3167caba9de1c572ab2632b87ce9d702d0dcacf0b.zip

  • Size

    513KB

  • Sample

    221025-r6zngsdaa8

  • MD5

    36d26ac77feb3f425e9a8e0bfe4506a6

  • SHA1

    69c4365619a209effeb63e5c9d595f90a635557f

  • SHA256

    7ac2e66dceae21d1f85037ce35960df034e0b47b142896521d7780926445eb50

  • SHA512

    496dc8e9000b48408c5546bd9c1eb695bff03217093524a23c839c72af19e65159e8b383876ca0e02f06db8651d6eb80acc9eae5166cbcb323f7fcfdff6d8ec9

  • SSDEEP

    12288:BbWtr89bkc/lt9c2piLHv4KL0MUcT0f6LixRDQGbhggDqeNw/zUKEoUUZ:sr8pkM39KDtHQfbxR1hgg9w/zURoP

Score
10/10
bazarbackdoorbackdoor

Malware Config

Targets

    • Target

      1a19ad73601c5636654ea6b3167caba9de1c572ab2632b87ce9d702d0dcacf0b

    • Size

      580KB

    • MD5

      b7d245ea334e2c1818cb757d7ef1f592

    • SHA1

      c7411c8440593fac4b576b3d89504bf94b04ed1d

    • SHA256

      1a19ad73601c5636654ea6b3167caba9de1c572ab2632b87ce9d702d0dcacf0b

    • SHA512

      daf198057de8563b81014619308a405455a2a12b6dd0f9c02042614d10a7c6a4a190f610634089d96b141f710e19fd3627cdfa70f133e4d54078ad6bf3870acb

    • SSDEEP

      6144:OJu7yDrEe9+FHM1sYr0JrU4ev9ZOh2At15jUR2EOjvktrYMZBxQTSAfGKEw:OJvD/Ys1l0JfW9H8C25jvMDZBxQ

    Score
    10/10
    bazarbackdoorbackdoor

    • BazarBackdoor

      Stealthy backdoor targeting corporate networks, believed to be developed by Trickbot's authors.

      backdoorbazarbackdoor

    • Tries to connect to .bazar domain

      Attempts to lookup or connect to a .bazar domain, used by BazarBackdoor, Trickbot, and potentially others.

    • Unexpected DNS network traffic destination

      Network traffic to other servers than the configured DNS servers was detected on the DNS port.

    behavioral1behavioral2

    • Target

      1a19ad73601c5636654ea6b3167caba9de1c572ab2632b87ce9d702d0dcacf0b_unpacked

    • Size

      178KB

    • MD5

      3c7dc6cd19e758840ed1aa76c8571f67

    • SHA1

      5f7b02bd8c8854adfb132817f0edae1771bcdb72

    • SHA256

      1d005321c8b45f25e1d012496e4fea43544c6f02af84d28c2c348fd04724d45c

    • SHA512

      ee9cf414295a9dbed765a290d6b6dd061e695149670c5809619ef4d3b38f7a1fb7a7e1273d1f3613db322d68e40d7770825eb70890c878b850c5f42477d9b15b

    • SSDEEP

      3072:vNcsPrIDUfRgcnOzJn/hJYxqWlDDgbOsSrIf4+udEB:+Y1IJZGzlDtrIcdg

    Score
    10/10
    bazarbackdoorbackdoor

    • BazarBackdoor

      Stealthy backdoor targeting corporate networks, believed to be developed by Trickbot's authors.

      backdoorbazarbackdoor

    • Tries to connect to .bazar domain

      Attempts to lookup or connect to a .bazar domain, used by BazarBackdoor, Trickbot, and potentially others.

    • Unexpected DNS network traffic destination

      Network traffic to other servers than the configured DNS servers was detected on the DNS port.

    behavioral3behavioral4

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Install Root Certificate

2
T1130

Modify Registry

2
T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks