bazarbackdoor | 1d005321c8b45f25e1d012496e4fea43544c6f02af84d28c2c348fd04724d45c | Triage

Sharing

General

Target

1a19ad73601c5636654ea6b3167caba9de1c572ab2632b87ce9d702d0dcacf0b_unpacked
Size

178KB
Sample

221026-1tc4dshcc7
MD5

3c7dc6cd19e758840ed1aa76c8571f67
SHA1

5f7b02bd8c8854adfb132817f0edae1771bcdb72
SHA256

1d005321c8b45f25e1d012496e4fea43544c6f02af84d28c2c348fd04724d45c
SHA512

ee9cf414295a9dbed765a290d6b6dd061e695149670c5809619ef4d3b38f7a1fb7a7e1273d1f3613db322d68e40d7770825eb70890c878b850c5f42477d9b15b
SSDEEP

3072:vNcsPrIDUfRgcnOzJn/hJYxqWlDDgbOsSrIf4+udEB:+Y1IJZGzlDtrIcdg

Score

10^/10

bazarbackdoor backdoor

Malware Config

Targets

- Target
  
  1a19ad73601c5636654ea6b3167caba9de1c572ab2632b87ce9d702d0dcacf0b_unpacked
- Size
  
  178KB
- MD5
  
  3c7dc6cd19e758840ed1aa76c8571f67
- SHA1
  
  5f7b02bd8c8854adfb132817f0edae1771bcdb72
- SHA256
  
  1d005321c8b45f25e1d012496e4fea43544c6f02af84d28c2c348fd04724d45c
- SHA512
  
  ee9cf414295a9dbed765a290d6b6dd061e695149670c5809619ef4d3b38f7a1fb7a7e1273d1f3613db322d68e40d7770825eb70890c878b850c5f42477d9b15b
- SSDEEP
  
  3072:vNcsPrIDUfRgcnOzJn/hJYxqWlDDgbOsSrIf4+udEB:+Y1IJZGzlDtrIcdg
Score

10^/10

bazarbackdoor backdoor
- BazarBackdoor
  Stealthy backdoor targeting corporate networks, believed to be developed by Trickbot's authors.
  backdoor bazarbackdoor
- Tries to connect to .bazar domain
  Attempts to lookup or connect to a .bazar domain, used by BazarBackdoor, Trickbot, and potentially others.
- Unexpected DNS network traffic destination
  Network traffic to other servers than the configured DNS servers was detected on the DNS port.
behavioral1 behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Install Root Certificate

Modify Registry

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks

static1

behavioral1

bazarbackdoorbackdoor

behavioral2

bazarbackdoorbackdoor