Overview

overview

10

Static

static

1

9f421930a7...18.exe

windows7-x64

10

9f421930a7...18.exe

windows10-2004-x64

1

Sharing

Copy URL
Twitter E-mail

General

  • Target

    9f421930a783c17dafe643189661be58_JaffaCakes118

  • Size

    323KB

  • Sample

    240816-vsz9mszfqr

  • MD5

    9f421930a783c17dafe643189661be58

  • SHA1

    05b99f2bbf1ec8cb8d2e4e63ded03548ea49239b

  • SHA256

    284e27af3b031e86213985cb444992eda7f5cabf8efc619f040c850c7adfc85e

  • SHA512

    8f47cfcd3c423962104a27e866ae151799c4904c875fd2dab541af6777102953d5eedd5f996a96114ceeabc2cfd3118747e58ff7a8b938fc03e3a3057f9e5e1c

  • SSDEEP

    6144:3I4KOympXst+asjCpeIFieYhUnUJSbH7rU/uWje6H9v2:3gOl9sGjY7uFmrzg9v2

Score
10/10
bazarloaderdropperloader

Malware Config

Targets

    • Target

      9f421930a783c17dafe643189661be58_JaffaCakes118

    • Size

      323KB

    • MD5

      9f421930a783c17dafe643189661be58

    • SHA1

      05b99f2bbf1ec8cb8d2e4e63ded03548ea49239b

    • SHA256

      284e27af3b031e86213985cb444992eda7f5cabf8efc619f040c850c7adfc85e

    • SHA512

      8f47cfcd3c423962104a27e866ae151799c4904c875fd2dab541af6777102953d5eedd5f996a96114ceeabc2cfd3118747e58ff7a8b938fc03e3a3057f9e5e1c

    • SSDEEP

      6144:3I4KOympXst+asjCpeIFieYhUnUJSbH7rU/uWje6H9v2:3gOl9sGjY7uFmrzg9v2

    Score
    10/10
    bazarloaderdropperloader

    • Bazar Loader

      Detected loader normally used to deploy BazarBackdoor malware.

      loaderdropperbazarloader

    • Bazar/Team9 Loader payload

    • Tries to connect to .bazar domain

      Attempts to lookup or connect to a .bazar domain, used by BazarBackdoor, Trickbot, and potentially others.

    • Unexpected DNS network traffic destination

      Network traffic to other servers than the configured DNS servers was detected on the DNS port.

    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks