Overview

overview

10

Static

static

1

Shadow-Fig...22.exe

windows7-x64

7

Shadow-Fig...22.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    Shadow-Fight-2_com.nekki.shadowfight_gameslolc_24881322.exe

  • Size

    2.7MB

  • Sample

    230225-gqphgacb8s

  • MD5

    dfd04a2324cce85466df915adca00971

  • SHA1

    4c1d81e090fb044e32438d99e76ba236d285fffa

  • SHA256

    f555bcbef5eb94bcb7d7beb0168feb8cd5bcf75236f385f2bc58405998b0aa0e

  • SHA512

    af8c68a11dc9765c9d35f8d95d7ab9f776244b36184346998039855826bdd56417a6ba9dabb9df295da827bad0f853e67001d72b8e22d8d35c772d3eb0365f71

  • SSDEEP

    49152:GvMEaA/BS7WQXBzdIXp6gvy6gLxfZQ6ugSoGltyrJplwwVwp5Vnu:Gyasiq66xRdu5UTlRwpnu

Score
10/10
bazarbackdoorbackdoorpersistence

Malware Config

Targets

    • Target

      Shadow-Fight-2_com.nekki.shadowfight_gameslolc_24881322.exe

    • Size

      2.7MB

    • MD5

      dfd04a2324cce85466df915adca00971

    • SHA1

      4c1d81e090fb044e32438d99e76ba236d285fffa

    • SHA256

      f555bcbef5eb94bcb7d7beb0168feb8cd5bcf75236f385f2bc58405998b0aa0e

    • SHA512

      af8c68a11dc9765c9d35f8d95d7ab9f776244b36184346998039855826bdd56417a6ba9dabb9df295da827bad0f853e67001d72b8e22d8d35c772d3eb0365f71

    • SSDEEP

      49152:GvMEaA/BS7WQXBzdIXp6gvy6gLxfZQ6ugSoGltyrJplwwVwp5Vnu:Gyasiq66xRdu5UTlRwpnu

    Score
    10/10
    bazarbackdoorbackdoorpersistence

    • BazarBackdoor

      Stealthy backdoor targeting corporate networks, believed to be developed by Trickbot's authors.

      backdoorbazarbackdoor

    • Bazar/Team9 Backdoor payload

    • Blocklisted process makes network request

    • Modifies Installed Components in the registry

      persistence

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Registers COM server for autorun

      persistence

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks