Overview

overview

10

Static

static

3

efad3e8098...18.dll

windows7-x64

10

efad3e8098...18.dll

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    efad3e8098fdc4778d1744abb659fb04_JaffaCakes118

  • Size

    537KB

  • Sample

    240414-2kyjeaad7v

  • MD5

    efad3e8098fdc4778d1744abb659fb04

  • SHA1

    90e28ff7cc0cc20ae2f10652f9ffda01107470ed

  • SHA256

    081409dbf0464baad30442d3f8cea67c885e15e438b0f6dbf9c64da67620eaa1

  • SHA512

    a203e6084df1fde1f037bf7071a901541cfed9e18f5924c3ee47176bba2256774774fb08214520792b0603aa9784836d58fc55b38c7d987cec8a9d1be8a83783

  • SSDEEP

    12288:DXI/lsYS/im/YnmCPksStIYotSPNwGG+Sft:DX67zmCPksUIYMO+GG+U

Score
10/10
bazarloaderdropperloader

Malware Config

Targets

    • Target

      efad3e8098fdc4778d1744abb659fb04_JaffaCakes118

    • Size

      537KB

    • MD5

      efad3e8098fdc4778d1744abb659fb04

    • SHA1

      90e28ff7cc0cc20ae2f10652f9ffda01107470ed

    • SHA256

      081409dbf0464baad30442d3f8cea67c885e15e438b0f6dbf9c64da67620eaa1

    • SHA512

      a203e6084df1fde1f037bf7071a901541cfed9e18f5924c3ee47176bba2256774774fb08214520792b0603aa9784836d58fc55b38c7d987cec8a9d1be8a83783

    • SSDEEP

      12288:DXI/lsYS/im/YnmCPksStIYotSPNwGG+Sft:DX67zmCPksUIYMO+GG+U

    Score
    10/10
    bazarloaderdropperloader

    • Bazar Loader

      Detected loader normally used to deploy BazarBackdoor malware.

      loaderdropperbazarloader

    • Bazar/Team9 Loader payload

    • Blocklisted process makes network request

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Subvert Trust Controls

1
T1553

Install Root Certificate

1
T1553.004

Modify Registry

1
T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Tasks