bazarbackdoor | c55f8979995df82555d66f6b197b0fbcb8fe30b431ff9760deae6927a584b9e3_dump7_0x0000000140000000 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

c55f8979995df82555d66f6b197b0fbcb8fe30b431ff9760deae6927a584b9e3_dump7_0x0000000140000000
Size

232KB
MD5

6fcd020477f50d464c04ba7dc8f15508
SHA1

d44049a5894505502a2178bef899b636dfed00f8
SHA256

210a47aecdb15c6937e2b1be98b359ba323c1d8deef09707c9436ffd1052ebb6
SHA512

d7886cb26edc8680bc60075fb6ead74bfa6d68e0896661722b6592d68f32793665d6a1c33c952bf635c79338ad10b581ea4c00556cc05fcff8b50b5c3308fde9
SSDEEP

6144:pMjYlrdBoHRDl02h/1uO5/hlK7wDQhpJYay:pMjUdBoHRD/lg4/PlDEXYa

Score

10^/10

bazarbackdoor

Malware Config

Signatures

Bazar/Team9 Backdoor payload 1 IoCs

resource	yara_rule
sample	BazarBackdoorVar3

Bazarbackdoor family
bazarbackdoor

Files

c55f8979995df82555d66f6b197b0fbcb8fe30b431ff9760deae6927a584b9e3_dump7_0x0000000140000000
.exe windows x64

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_ISOLATION
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Sections

.text
Size: 141KB - Virtual size: 140KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 47KB - Virtual size: 46KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 3KB - Virtual size: 14KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 6KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 512B - Virtual size: 16B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ