bazarbackdoor

General

Target

MBSetup.exe
Size

2.5MB
Sample

230407-z4e53ace5z
MD5

1ed0d8b2214a5d067d5422145689f747
SHA1

e671419cc7957c1118b9bb84251a40c03351f07f
SHA256

06a4bacdae17ad89c8fc93fc4ebf6603ca406e8bcc51f3fd32f700d18436be56
SHA512

e2a686efcb1bcda6b55c5d10654124fc2b27c426a979929a1e9de171794745abc9f0cd9dbd302a4e02d95269c7abee5dd051c1687e8f794da317b3fc4bf665b8
SSDEEP

24576:05mJfwapNdG219GpuNXCtbKoYFYE4XcUaOECcW0wd/ZL8Ug+JwNZgCxiIsCA2flq:0GNd28XOJYFYtcOcW0wxZN2DxiIq2dnq

Score

10^/10

Malware Config

Targets

- Target
  
  MBSetup.exe
- Size
  
  2.5MB
- MD5
  
  1ed0d8b2214a5d067d5422145689f747
- SHA1
  
  e671419cc7957c1118b9bb84251a40c03351f07f
- SHA256
  
  06a4bacdae17ad89c8fc93fc4ebf6603ca406e8bcc51f3fd32f700d18436be56
- SHA512
  
  e2a686efcb1bcda6b55c5d10654124fc2b27c426a979929a1e9de171794745abc9f0cd9dbd302a4e02d95269c7abee5dd051c1687e8f794da317b3fc4bf665b8
- SSDEEP
  
  24576:05mJfwapNdG219GpuNXCtbKoYFYE4XcUaOECcW0wd/ZL8Ug+JwNZgCxiIsCA2flq:0GNd28XOJYFYtcOcW0wxZN2DxiIq2dnq
Score

10^/10

bazarbackdoor backdoor discovery persistence spyware stealer
- BazarBackdoor
  Stealthy backdoor targeting corporate networks, believed to be developed by Trickbot's authors.
  backdoor bazarbackdoor
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Bazar/Team9 Backdoor payload
- Downloads MZ/PE file
- Drops file in Drivers directory
- Modifies RDP port number used by Windows
- Sets service image path in registry
  persistence
- Checks BIOS information in registry
  BIOS information is often read in order to detect sandboxing environments.
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Registers COM server for autorun
  persistence
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Drops file in System32 directory
behavioral1