Overview

overview

10

Static

static

3

4e02ce310c...7a.dll

windows7-x64

10

4e02ce310c...7a.dll

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    4e02ce310c2b7a1cebb58714781de17a

  • Size

    338KB

  • Sample

    240109-lz42qseacr

  • MD5

    4e02ce310c2b7a1cebb58714781de17a

  • SHA1

    48eb0eae7c68be446d6bdc9f44bd2ee2e286f2cf

  • SHA256

    56772dca4331188918e3763a9e934e9c8e5994c06daf158f745419a4256dac91

  • SHA512

    1e384b595802ac9a153a578ac617ef421aa6fd7cfd9bfc10f0ab4ddaffd2f2be7fac6bb377eebe3c60c6f97ca4b29617de2925520bde524c70ff03d896b3d99e

  • SSDEEP

    6144:uZwKn8bxurvfUCEs7I4V2PsqHMc/PZ6RguROla0CWecIdn9TCwC6dU:zTbxuLfUCR2kQMgZ6W4OIePAU

Score
10/10
bazarloaderdropperloader

Malware Config

Targets

    • Target

      4e02ce310c2b7a1cebb58714781de17a

    • Size

      338KB

    • MD5

      4e02ce310c2b7a1cebb58714781de17a

    • SHA1

      48eb0eae7c68be446d6bdc9f44bd2ee2e286f2cf

    • SHA256

      56772dca4331188918e3763a9e934e9c8e5994c06daf158f745419a4256dac91

    • SHA512

      1e384b595802ac9a153a578ac617ef421aa6fd7cfd9bfc10f0ab4ddaffd2f2be7fac6bb377eebe3c60c6f97ca4b29617de2925520bde524c70ff03d896b3d99e

    • SSDEEP

      6144:uZwKn8bxurvfUCEs7I4V2PsqHMc/PZ6RguROla0CWecIdn9TCwC6dU:zTbxuLfUCR2kQMgZ6W4OIePAU

    Score
    10/10
    bazarloaderdropperloader

    • Bazar Loader

      Detected loader normally used to deploy BazarBackdoor malware.

      loaderdropperbazarloader

    • Bazar/Team9 Loader payload

    • Blocklisted process makes network request

    • Tries to connect to .bazar domain

      Attempts to lookup or connect to a .bazar domain, used by BazarBackdoor, Trickbot, and potentially others.

    • Unexpected DNS network traffic destination

      Network traffic to other servers than the configured DNS servers was detected on the DNS port.

    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks