bazarbackdoor

General

Target

TLauncher-2.876-Installer-1.0.7.exe
Size

22.7MB
Sample

230319-lx8xxahh9w
MD5

d2ed0869a108f2abfa557e90595f90a6
SHA1

178bb5c3ca43537803110e9d24446ededfc65073
SHA256

a4ff6ac33f545c591a3974d52f83f751abbba7b3ad33bc0b47611dcd620cd8db
SHA512

09c56700012252e1b88119b597410b86412b5ae9cd27585d49e8567160d56c34df4d49d42bca207acc38ee721d9a269d262e0bb113a967d260d58f93113515be
SSDEEP

393216:AXHgRSooP0wpAVl/Pfs/dQETVlOBbpFEjdGphRqV56HpkvQFa2Vj4h2cO:A3IdO0wqfHHExi73qqHpU2Vj4h+

Score

10^/10

Malware Config

Targets

- Target
  
  TLauncher-2.876-Installer-1.0.7.exe
- Size
  
  22.7MB
- MD5
  
  d2ed0869a108f2abfa557e90595f90a6
- SHA1
  
  178bb5c3ca43537803110e9d24446ededfc65073
- SHA256
  
  a4ff6ac33f545c591a3974d52f83f751abbba7b3ad33bc0b47611dcd620cd8db
- SHA512
  
  09c56700012252e1b88119b597410b86412b5ae9cd27585d49e8567160d56c34df4d49d42bca207acc38ee721d9a269d262e0bb113a967d260d58f93113515be
- SSDEEP
  
  393216:AXHgRSooP0wpAVl/Pfs/dQETVlOBbpFEjdGphRqV56HpkvQFa2Vj4h2cO:A3IdO0wqfHHExi73qqHpU2Vj4h+
Score

10^/10

bazarbackdoor adware backdoor discovery persistence spyware stealer upx
- BazarBackdoor
  Stealthy backdoor targeting corporate networks, believed to be developed by Trickbot's authors.
  backdoor bazarbackdoor
- Bazar/Team9 Backdoor payload
- Blocklisted process makes network request
- Downloads MZ/PE file
- Executes dropped EXE
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Registers COM server for autorun
  persistence
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Installs/modifies Browser Helper Object
  BHOs are DLL modules which act as plugins for Internet Explorer.
  stealer adware
- Drops file in System32 directory
behavioral1