bazarbackdoor | 1d005321c8b45f25e1d012496e4fea43544c6f02af84d28c2c348fd04724d45c

Resubmissions

27-10-2024 20:10

27-10-2024 20:09

12-10-2024 23:03

max time kernel
133s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
12-10-2024 23:03

Target

3c7dc6cd19e758840ed1aa76c8571f67_JaffaCakes118.exe
Size

178KB
MD5

3c7dc6cd19e758840ed1aa76c8571f67
SHA1

5f7b02bd8c8854adfb132817f0edae1771bcdb72
SHA256

1d005321c8b45f25e1d012496e4fea43544c6f02af84d28c2c348fd04724d45c
SHA512

ee9cf414295a9dbed765a290d6b6dd061e695149670c5809619ef4d3b38f7a1fb7a7e1273d1f3613db322d68e40d7770825eb70890c878b850c5f42477d9b15b
SSDEEP

3072:vNcsPrIDUfRgcnOzJn/hJYxqWlDDgbOsSrIf4+udEB:+Y1IJZGzlDtrIcdg

Score

10^/10

BazarBackdoor 2 IoCs

Stealthy backdoor targeting corporate networks, believed to be developed by Trickbot's authors.

description	flow	ioc	Process
HTTP URL	51	https://85.143.221.85/api/v134	Process not Found
Key created		\REGISTRY\MACHINE\Software\Microsoft\SystemCertificates\Root	3c7dc6cd19e758840ed1aa76c8571f67_JaffaCakes118.exe

Tries to connect to .bazar domain 1 IoCs

Attempts to lookup or connect to a .bazar domain, used by BazarBackdoor, Trickbot, and potentially others.

description	flow	ioc
HTTP URL	51	https://85.143.221.85/api/v134

C:\Users\Admin\AppData\Local\Temp\3c7dc6cd19e758840ed1aa76c8571f67_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\3c7dc6cd19e758840ed1aa76c8571f67_JaffaCakes118.exe"
1⤵
- BazarBackdoor
PID:1428

C:\Users\Admin\AppData\Local\Temp\3c7dc6cd19e758840ed1aa76c8571f67_JaffaCakes118.exe
C:\Users\Admin\AppData\Local\Temp\3c7dc6cd19e758840ed1aa76c8571f67_JaffaCakes118.exe {77C8F83C-C07C-43B2-8FDF-CC65892F099A}
1⤵
PID:872