Overview

overview

10

Static

static

1

757d03cfa2...18.exe

windows7-x64

10

757d03cfa2...18.exe

windows10-2004-x64

1

Sharing

Copy URL
Twitter E-mail

General

  • Target

    757d03cfa2c8f8b0e69ad134e943196f_JaffaCakes118

  • Size

    409KB

  • Sample

    240730-r8mfyazare

  • MD5

    757d03cfa2c8f8b0e69ad134e943196f

  • SHA1

    521fe485d1b8ea57c5722cfdef740c0f734064e0

  • SHA256

    f84743453a41f1d1f844eb322519f4d009a6ccd0548cb30233504dba70546973

  • SHA512

    3632d3dd2d44409b5aff218c90b7b5bc7471009ef3fb0598ae5c23eb76bce8d8f64dc7f7f6b182c24809c41b3d4ba8c9a0ad796e5906d7ec18b3c2d1854f789c

  • SSDEEP

    6144:v9+gMUl3ABcePxWVKOzzPmazk5UXfeBCQlXpZkNPP9TD2sQy3sNyiY:F+gTfeP7Omik5UCl5ZkVVDj3AJY

Score
10/10
bazarloaderdropperloader

Malware Config

Targets

    • Target

      757d03cfa2c8f8b0e69ad134e943196f_JaffaCakes118

    • Size

      409KB

    • MD5

      757d03cfa2c8f8b0e69ad134e943196f

    • SHA1

      521fe485d1b8ea57c5722cfdef740c0f734064e0

    • SHA256

      f84743453a41f1d1f844eb322519f4d009a6ccd0548cb30233504dba70546973

    • SHA512

      3632d3dd2d44409b5aff218c90b7b5bc7471009ef3fb0598ae5c23eb76bce8d8f64dc7f7f6b182c24809c41b3d4ba8c9a0ad796e5906d7ec18b3c2d1854f789c

    • SSDEEP

      6144:v9+gMUl3ABcePxWVKOzzPmazk5UXfeBCQlXpZkNPP9TD2sQy3sNyiY:F+gTfeP7Omik5UCl5ZkVVDj3AJY

    Score
    10/10
    bazarloaderdropperloader

    • Bazar Loader

      Detected loader normally used to deploy BazarBackdoor malware.

      loaderdropperbazarloader

    • Bazar/Team9 Loader payload

    • Tries to connect to .bazar domain

      Attempts to lookup or connect to a .bazar domain, used by BazarBackdoor, Trickbot, and potentially others.

    • Unexpected DNS network traffic destination

      Network traffic to other servers than the configured DNS servers was detected on the DNS port.

    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks