bazarbackdoor

General

Target

MBSetup.exe
Size

2.5MB
Sample

230416-z28placb22
MD5

7edb9901d4f80c13ac1e0eafce2decb1
SHA1

8b8ff3f0af39e3bc5fcea8cf38366ad65d263786
SHA256

057ac0f95e80abc5c73d9aefbc4e5e1bb778c2c154bf65c35435a34cdaf3da94
SHA512

a15443f7c41e4cac4c9f2d6f98939914dbef715a0bb47a6119e45ac8ebe923faa3afa3462980e2029d0cbe3c56648f5bc9ca746872c5fed2205e64c6d4b80a87
SSDEEP

49152:byOnDrv8gSD0JRTPme0wxZN2DxiIq2dOe:u8YgSDu3/WRq2ke

Score

10^/10

Malware Config

Targets

- Target
  
  MBSetup.exe
- Size
  
  2.5MB
- MD5
  
  7edb9901d4f80c13ac1e0eafce2decb1
- SHA1
  
  8b8ff3f0af39e3bc5fcea8cf38366ad65d263786
- SHA256
  
  057ac0f95e80abc5c73d9aefbc4e5e1bb778c2c154bf65c35435a34cdaf3da94
- SHA512
  
  a15443f7c41e4cac4c9f2d6f98939914dbef715a0bb47a6119e45ac8ebe923faa3afa3462980e2029d0cbe3c56648f5bc9ca746872c5fed2205e64c6d4b80a87
- SSDEEP
  
  49152:byOnDrv8gSD0JRTPme0wxZN2DxiIq2dOe:u8YgSDu3/WRq2ke
Score

10^/10

discovery bazarbackdoor backdoor persistence spyware stealer
- BazarBackdoor
  Stealthy backdoor targeting corporate networks, believed to be developed by Trickbot's authors.
  backdoor bazarbackdoor
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Bazar/Team9 Backdoor payload
- Downloads MZ/PE file
- Drops file in Drivers directory
- Modifies RDP port number used by Windows
- Sets service image path in registry
  persistence
- Checks BIOS information in registry
  BIOS information is often read in order to detect sandboxing environments.
- Executes dropped EXE
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Registers COM server for autorun
  persistence
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Drops file in System32 directory
behavioral1 behavioral2