Overview

overview

10

Static

static

3

f829e1a9cf...18.dll

windows7-x64

10

f829e1a9cf...18.dll

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    f829e1a9cf136d94f832c275f6d1f008_JaffaCakes118

  • Size

    1.2MB

  • Sample

    240418-rgnjxsgd4s

  • MD5

    f829e1a9cf136d94f832c275f6d1f008

  • SHA1

    6f695e3924dbb1d6d216250ea8da39987a70cf4b

  • SHA256

    2c59b6a90799fe245b4bcd608bab37b0a3750bacaa886eda9c1e32c9e8b6f84f

  • SHA512

    d8f3f5cc1a8e616515f9cf5bb6934fa6c6627a16713bbefdcf7d81ecaf4f41b657490759ae089fdeaac5f960d19acd92dd25bf9385189c0b37a13ff7048bacd8

  • SSDEEP

    12288:6yWeahQ/LWnzkXz5HYrniajhuSlHJzJBlPXXo/6aNdCaBSPZC1XZV72B4:HWeaZzqY7dhBjz/lfo/FIyXv72B4

Score
10/10
bazarloaderdropperloader

Malware Config

Targets

    • Target

      f829e1a9cf136d94f832c275f6d1f008_JaffaCakes118

    • Size

      1.2MB

    • MD5

      f829e1a9cf136d94f832c275f6d1f008

    • SHA1

      6f695e3924dbb1d6d216250ea8da39987a70cf4b

    • SHA256

      2c59b6a90799fe245b4bcd608bab37b0a3750bacaa886eda9c1e32c9e8b6f84f

    • SHA512

      d8f3f5cc1a8e616515f9cf5bb6934fa6c6627a16713bbefdcf7d81ecaf4f41b657490759ae089fdeaac5f960d19acd92dd25bf9385189c0b37a13ff7048bacd8

    • SSDEEP

      12288:6yWeahQ/LWnzkXz5HYrniajhuSlHJzJBlPXXo/6aNdCaBSPZC1XZV72B4:HWeaZzqY7dhBjz/lfo/FIyXv72B4

    Score
    10/10
    bazarloaderdropperloader

    • Bazar Loader

      Detected loader normally used to deploy BazarBackdoor malware.

      loaderdropperbazarloader

    • Bazar/Team9 Loader payload

    • Blocklisted process makes network request

    • Tries to connect to .bazar domain

      Attempts to lookup or connect to a .bazar domain, used by BazarBackdoor, Trickbot, and potentially others.

    • Unexpected DNS network traffic destination

      Network traffic to other servers than the configured DNS servers was detected on the DNS port.

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Subvert Trust Controls

1
T1553

Install Root Certificate

1
T1553.004

Modify Registry

1
T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Tasks