Overview

overview

10

Static

static

1

TLauncher-...al.exe

windows7-x64

10

TLauncher-...al.exe

windows10-2004-x64

7

Sharing

Copy URL
Twitter E-mail

General

  • Target

    TLauncher-2.876-Installer-1.0.6-global.exe

  • Size

    22.6MB

  • Sample

    230308-1gx8sshc46

  • MD5

    2c46460b0b6c89f4993db4ab214fc9ee

  • SHA1

    0a8b0696a59d2635f2303a4f2302cd97ea6d835a

  • SHA256

    7efd1055ea05a8fb0e8dab395b68017720d468d3ffb3ef3baeb501f809528827

  • SHA512

    e79fc7a3bdea24e2425f56b94399b7b732436bec6dc5de3e416a0e0e43ddd8044fc83992f4a1d7a1f86397957f808ce93a40c58c1101566af77a0f62e85a7c44

  • SSDEEP

    393216:YXMHKmnDMP/n8IPfs/dQETVlOBbpFEjdGphRqV56HpkvQFa2Vj4h2cv:Y8q8MH8aHExi73qqHpU2Vj4h/

Score
10/10
bazarbackdoorbackdoordiscoveryupx

Malware Config

Targets

    • Target

      TLauncher-2.876-Installer-1.0.6-global.exe

    • Size

      22.6MB

    • MD5

      2c46460b0b6c89f4993db4ab214fc9ee

    • SHA1

      0a8b0696a59d2635f2303a4f2302cd97ea6d835a

    • SHA256

      7efd1055ea05a8fb0e8dab395b68017720d468d3ffb3ef3baeb501f809528827

    • SHA512

      e79fc7a3bdea24e2425f56b94399b7b732436bec6dc5de3e416a0e0e43ddd8044fc83992f4a1d7a1f86397957f808ce93a40c58c1101566af77a0f62e85a7c44

    • SSDEEP

      393216:YXMHKmnDMP/n8IPfs/dQETVlOBbpFEjdGphRqV56HpkvQFa2Vj4h2cv:Y8q8MH8aHExi73qqHpU2Vj4h/

    Score
    10/10
    bazarbackdoorbackdoordiscoveryupx

    • BazarBackdoor

      Stealthy backdoor targeting corporate networks, believed to be developed by Trickbot's authors.

      backdoorbazarbackdoor

    • Bazar/Team9 Backdoor payload

    • Blocklisted process makes network request

    • Downloads MZ/PE file

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks