Overview

overview

10

Static

static

1

redirect.html

windows7-x64

10

redirect.html

windows10-2004-x64

1

Sharing

Copy URL
Twitter E-mail

General

  • Target

    redirect

  • Size

    6KB

  • Sample

    230404-s4bdjsgc94

  • MD5

    e6279de86bd3f26bec60a8578735fa88

  • SHA1

    b141a95f20b275000718fbf3c5122145327aad1c

  • SHA256

    a0004c709e57bf251069a1ef097ff5fa47b7bb8cd99622fc6d0bd155f803e5ab

  • SHA512

    0cc2b123ca9772a31ed2aa4ce36041e8083aa81a8dc89d53d1f25e38eba02d069d4e68eed7281e8ceab815ad2cc5da174ca065dcff063c40bdd9baa5e04f9355

  • SSDEEP

    192:dFHLxX7777/77QF7o0LCARd4BBsIIgdOyF:dFr5HYi0MsIddOy

Score
10/10
bazarbackdoorbackdoordiscoveryevasiontrojanupx

Malware Config

Targets

    • Target

      redirect

    • Size

      6KB

    • MD5

      e6279de86bd3f26bec60a8578735fa88

    • SHA1

      b141a95f20b275000718fbf3c5122145327aad1c

    • SHA256

      a0004c709e57bf251069a1ef097ff5fa47b7bb8cd99622fc6d0bd155f803e5ab

    • SHA512

      0cc2b123ca9772a31ed2aa4ce36041e8083aa81a8dc89d53d1f25e38eba02d069d4e68eed7281e8ceab815ad2cc5da174ca065dcff063c40bdd9baa5e04f9355

    • SSDEEP

      192:dFHLxX7777/77QF7o0LCARd4BBsIIgdOyF:dFr5HYi0MsIddOy

    Score
    10/10
    bazarbackdoorbackdoordiscoveryevasiontrojanupx

    • BazarBackdoor

      Stealthy backdoor targeting corporate networks, believed to be developed by Trickbot's authors.

      backdoorbazarbackdoor

    • Bazar/Team9 Backdoor payload

    • Downloads MZ/PE file

    • Executes dropped EXE

    • Loads dropped DLL

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery

    • Checks whether UAC is enabled

      evasiontrojan
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks