Overview

overview

10

Static

static

1

disable-devtool.html

windows7-x64

10

disable-devtool.html

windows10-2004-x64

1

Sharing

Copy URL
Twitter E-mail

General

  • Target

    disable-devtool

  • Size

    6KB

  • Sample

    230402-ff2jlseg57

  • MD5

    52e11736d611c09aef6081ae8655387e

  • SHA1

    240254d8a05b2da8fa268093d6d8f5e5e53d7c5f

  • SHA256

    0ec87e23086f2954dccd869ed920c070a200ebe5592e41ae9ae1c5cd8013d8b3

  • SHA512

    4d66419e762ef0b85fab9fdb10bafcd070a7998d5186e770b1269e21d65debe9c10f9157b9deb08426b596689631d8a08da2817711caf06147f2975d4ea229e2

  • SSDEEP

    192:1d/tFvaJB5fqAMbRe5P8CoLzBIqgD+5PHUhM:jlF5rCoLzBIqN+M

Score
10/10
bazarbackdoorbackdoordiscoveryupx

Malware Config

Targets

    • Target

      disable-devtool

    • Size

      6KB

    • MD5

      52e11736d611c09aef6081ae8655387e

    • SHA1

      240254d8a05b2da8fa268093d6d8f5e5e53d7c5f

    • SHA256

      0ec87e23086f2954dccd869ed920c070a200ebe5592e41ae9ae1c5cd8013d8b3

    • SHA512

      4d66419e762ef0b85fab9fdb10bafcd070a7998d5186e770b1269e21d65debe9c10f9157b9deb08426b596689631d8a08da2817711caf06147f2975d4ea229e2

    • SSDEEP

      192:1d/tFvaJB5fqAMbRe5P8CoLzBIqgD+5PHUhM:jlF5rCoLzBIqN+M

    Score
    10/10
    bazarbackdoorbackdoordiscoveryupx

    • BazarBackdoor

      Stealthy backdoor targeting corporate networks, believed to be developed by Trickbot's authors.

      backdoorbazarbackdoor

    • Bazar/Team9 Backdoor payload

    • Blocklisted process makes network request

    • Downloads MZ/PE file

    • Executes dropped EXE

    • Loads dropped DLL

    • Modifies file permissions

      discovery

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks