Overview

overview

10

Static

static

3

2a2dd2c796...2e.dll

windows7-x64

10

2a2dd2c796...2e.dll

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    2a2dd2c7969c12c1202e16e0a9e33a2e

  • Size

    752KB

  • Sample

    231219-p5vl2agecj

  • MD5

    2a2dd2c7969c12c1202e16e0a9e33a2e

  • SHA1

    578de23c3b1ecc8c1a357da622d9a516a27e3dd3

  • SHA256

    d14f75f7eb189289fddfc70e7096afd53640efa043f94427c8d08e633593c261

  • SHA512

    0074e55ff2ef09a58a8506926f03e39d3522e8b8af6b9dc6143bce3ee435a8cf554e5d0049b705f36c043007076203ba3c9af159ccadb20b6264d89d52b12268

  • SSDEEP

    12288:fT4Hx+QLMJYKYcBH6Z7t7GMVR7pM7L2rn65hYZJA0Q:6+QIma+7t7ZP7iQn652XA

Score
10/10
bazarloaderdropperloader

Malware Config

Targets

    • Target

      2a2dd2c7969c12c1202e16e0a9e33a2e

    • Size

      752KB

    • MD5

      2a2dd2c7969c12c1202e16e0a9e33a2e

    • SHA1

      578de23c3b1ecc8c1a357da622d9a516a27e3dd3

    • SHA256

      d14f75f7eb189289fddfc70e7096afd53640efa043f94427c8d08e633593c261

    • SHA512

      0074e55ff2ef09a58a8506926f03e39d3522e8b8af6b9dc6143bce3ee435a8cf554e5d0049b705f36c043007076203ba3c9af159ccadb20b6264d89d52b12268

    • SSDEEP

      12288:fT4Hx+QLMJYKYcBH6Z7t7GMVR7pM7L2rn65hYZJA0Q:6+QIma+7t7ZP7iQn652XA

    Score
    10/10
    bazarloaderdropperloader

    • Bazar Loader

      Detected loader normally used to deploy BazarBackdoor malware.

      loaderdropperbazarloader

    • Bazar/Team9 Loader payload

    • Blocklisted process makes network request

    • Tries to connect to .bazar domain

      Attempts to lookup or connect to a .bazar domain, used by BazarBackdoor, Trickbot, and potentially others.

    • Unexpected DNS network traffic destination

      Network traffic to other servers than the configured DNS servers was detected on the DNS port.

    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks