Overview

overview

10

Static

static

8

9372104ec9...9a.exe

windows7-x64

10

9372104ec9...9a.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    9372104ec9a78ada0d13de64f68a55e7b42857bc1da6b778f59071039e1f1b9a

  • Size

    43.5MB

  • Sample

    221119-pdg7maah38

  • MD5

    379eeae351cb074d4500be04d73bd116

  • SHA1

    1a7f13231d50e9e5b84bfe582576cdcfe7bceec0

  • SHA256

    9372104ec9a78ada0d13de64f68a55e7b42857bc1da6b778f59071039e1f1b9a

  • SHA512

    282ea5c03502c2d8ab466d4ee80ef0ed286cd421c14dce00bd9267c6a405c8cbbe02487e20f209ba4852b1e3ddb1963801ad7f9558a7a30a7278722ee338f805

  • SSDEEP

    786432:Qn5lSOGApJPAHuXkw7/UQs2MMNixxG1cghRFbbraU3VvcMzztsIxH0:QnGgAOXkw22sx8cEFbbGKNzz/J0

Score
10/10
bazarbackdoorbackdoorbootkitpersistenceupx

Malware Config

Targets

    • Target

      9372104ec9a78ada0d13de64f68a55e7b42857bc1da6b778f59071039e1f1b9a

    • Size

      43.5MB

    • MD5

      379eeae351cb074d4500be04d73bd116

    • SHA1

      1a7f13231d50e9e5b84bfe582576cdcfe7bceec0

    • SHA256

      9372104ec9a78ada0d13de64f68a55e7b42857bc1da6b778f59071039e1f1b9a

    • SHA512

      282ea5c03502c2d8ab466d4ee80ef0ed286cd421c14dce00bd9267c6a405c8cbbe02487e20f209ba4852b1e3ddb1963801ad7f9558a7a30a7278722ee338f805

    • SSDEEP

      786432:Qn5lSOGApJPAHuXkw7/UQs2MMNixxG1cghRFbbraU3VvcMzztsIxH0:QnGgAOXkw22sx8cEFbbGKNzz/J0

    Score
    10/10
    bazarbackdoorbackdoorbootkitpersistenceupx

    • BazarBackdoor

      Stealthy backdoor targeting corporate networks, believed to be developed by Trickbot's authors.

      backdoorbazarbackdoor

    • Bazar/Team9 Backdoor payload

    • Executes dropped EXE

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • Loads dropped DLL

    • Writes to the Master Boot Record (MBR)

      Bootkits write to the MBR to gain persistence at a level below the operating system.

      bootkitpersistence

    • Suspicious use of NtSetInformationThreadHideFromDebugger

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Bootkit

1
T1067

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks