Overview

overview

10

Static

static

3

3c7dc6cd19...18.exe

windows11-21h2-x64

10

Resubmissions

27-10-2024 20:10

241027-yxvfqssfjl 10

27-10-2024 20:09

241027-yw56vasern 10

12-10-2024 23:03

241012-21re2awemd 10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    3c7dc6cd19e758840ed1aa76c8571f67_JaffaCakes118

  • Size

    178KB

  • Sample

    241027-yw56vasern

  • MD5

    3c7dc6cd19e758840ed1aa76c8571f67

  • SHA1

    5f7b02bd8c8854adfb132817f0edae1771bcdb72

  • SHA256

    1d005321c8b45f25e1d012496e4fea43544c6f02af84d28c2c348fd04724d45c

  • SHA512

    ee9cf414295a9dbed765a290d6b6dd061e695149670c5809619ef4d3b38f7a1fb7a7e1273d1f3613db322d68e40d7770825eb70890c878b850c5f42477d9b15b

  • SSDEEP

    3072:vNcsPrIDUfRgcnOzJn/hJYxqWlDDgbOsSrIf4+udEB:+Y1IJZGzlDtrIcdg

Score
10/10
bazarbackdoorbackdoordiscovery

Malware Config

Targets

    • Target

      3c7dc6cd19e758840ed1aa76c8571f67_JaffaCakes118

    • Size

      178KB

    • MD5

      3c7dc6cd19e758840ed1aa76c8571f67

    • SHA1

      5f7b02bd8c8854adfb132817f0edae1771bcdb72

    • SHA256

      1d005321c8b45f25e1d012496e4fea43544c6f02af84d28c2c348fd04724d45c

    • SHA512

      ee9cf414295a9dbed765a290d6b6dd061e695149670c5809619ef4d3b38f7a1fb7a7e1273d1f3613db322d68e40d7770825eb70890c878b850c5f42477d9b15b

    • SSDEEP

      3072:vNcsPrIDUfRgcnOzJn/hJYxqWlDDgbOsSrIf4+udEB:+Y1IJZGzlDtrIcdg

    Score
    10/10
    bazarbackdoorbackdoordiscovery

    • BazarBackdoor

      Stealthy backdoor targeting corporate networks, believed to be developed by Trickbot's authors.

      backdoorbazarbackdoor

    • Bazarbackdoor family

      bazarbackdoor

    • Contacts a large (5005) amount of remote hosts

      This may indicate a network scan to discover remotely running services.

      discovery

    • Tries to connect to .bazar domain

      Attempts to lookup or connect to a .bazar domain, used by BazarBackdoor, Trickbot, and potentially others.

    • Unexpected DNS network traffic destination

      Network traffic to other servers than the configured DNS servers was detected on the DNS port.

    • Creates a large amount of network flows

      This may indicate a network scan to discover remotely running services.

      discovery
    behavioral1

MITRE ATT&CK Enterprise v15

Tasks