Overview

overview

10

Static

static

3

40fddbbfbb...fe.dll

windows7-x64

10

40fddbbfbb...fe.dll

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    40fddbbfbb45012b7bf00985547d70fe

  • Size

    1.2MB

  • Sample

    240104-qsfssabge7

  • MD5

    40fddbbfbb45012b7bf00985547d70fe

  • SHA1

    23e0b6b8db4f2d4479df7dd51867474567d480bf

  • SHA256

    bb42fe3d20e3fae9bf0e1be683134b526386cf36e99a6aaed14a08bbfc627294

  • SHA512

    ceda59bcc7c7ae695050419278f6710645d452845bd70f60c3a1f9867e58baf6614852dd22b05f8c49e88a70bf8afe0ef0dae429c31f91431425ded7ba7b072f

  • SSDEEP

    24576:0Wpc+G43nwqthqmmldpXoQ5IyXdLrgvHmrR:8+n3Hthqm9qgkR

Score
10/10
bazarloaderdropperloader

Malware Config

Targets

    • Target

      40fddbbfbb45012b7bf00985547d70fe

    • Size

      1.2MB

    • MD5

      40fddbbfbb45012b7bf00985547d70fe

    • SHA1

      23e0b6b8db4f2d4479df7dd51867474567d480bf

    • SHA256

      bb42fe3d20e3fae9bf0e1be683134b526386cf36e99a6aaed14a08bbfc627294

    • SHA512

      ceda59bcc7c7ae695050419278f6710645d452845bd70f60c3a1f9867e58baf6614852dd22b05f8c49e88a70bf8afe0ef0dae429c31f91431425ded7ba7b072f

    • SSDEEP

      24576:0Wpc+G43nwqthqmmldpXoQ5IyXdLrgvHmrR:8+n3Hthqm9qgkR

    Score
    10/10
    bazarloaderdropperloader

    • Bazar Loader

      Detected loader normally used to deploy BazarBackdoor malware.

      loaderdropperbazarloader

    • Bazar/Team9 Loader payload

    • Blocklisted process makes network request

    • Tries to connect to .bazar domain

      Attempts to lookup or connect to a .bazar domain, used by BazarBackdoor, Trickbot, and potentially others.

    • Unexpected DNS network traffic destination

      Network traffic to other servers than the configured DNS servers was detected on the DNS port.

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks