bazarloader | 9a28953b692d27b8874674c0750f1308043700bd28e25d4b8985c25e19294a91 | Triage

Submit
Reports

Overview

overview

Static

static

3

9a28953b69...91.dll

windows7-x64

9a28953b69...91.dll

windows10-2004-x64

Sharing

General

Target

9a28953b692d27b8874674c0750f1308043700bd28e25d4b8985c25e19294a91.exe
Size

538KB
Sample

241120-ycff3s1fnc
MD5

8043b149f5d8cfa726988270788421e0
SHA1

e02f8cb694a25e33d265a27f6b407aeef7d0115f
SHA256

9a28953b692d27b8874674c0750f1308043700bd28e25d4b8985c25e19294a91
SHA512

161e38656415b8724100449e66ac33d22009f01ba565f16bcf3465b4d82a1a0dde2241c3e6615fcbbdd9ba89a83e0f192c6669acf964454e0a65dc9e85613dff
SSDEEP

12288:iJauNk3uCZ50K0oyeJL+ZjoVRWyh3ibZKNgPAhtxxA:iQV+JK0oyeJL+ZjkwyhybsNkAE

Score

10^/10

bazarloader dropper loader

Static task

static1

1 signatures

Behavioral task

behavioral1

Sample

9a28953b692d27b8874674c0750f1308043700bd28e25d4b8985c25e19294a91.dll

Resource

win7-20240903-en

bazarloader dropper loader

windows7-x64

7 signatures

120 seconds

Behavioral task

behavioral2

Sample

9a28953b692d27b8874674c0750f1308043700bd28e25d4b8985c25e19294a91.dll

Resource

win10v2004-20241007-en

bazarloader dropper loader

windows10-2004-x64

6 signatures

120 seconds

Malware Config

Targets

- Target
  
  9a28953b692d27b8874674c0750f1308043700bd28e25d4b8985c25e19294a91.exe
- Size
  
  538KB
- MD5
  
  8043b149f5d8cfa726988270788421e0
- SHA1
  
  e02f8cb694a25e33d265a27f6b407aeef7d0115f
- SHA256
  
  9a28953b692d27b8874674c0750f1308043700bd28e25d4b8985c25e19294a91
- SHA512
  
  161e38656415b8724100449e66ac33d22009f01ba565f16bcf3465b4d82a1a0dde2241c3e6615fcbbdd9ba89a83e0f192c6669acf964454e0a65dc9e85613dff
- SSDEEP
  
  12288:iJauNk3uCZ50K0oyeJL+ZjoVRWyh3ibZKNgPAhtxxA:iQV+JK0oyeJL+ZjkwyhybsNkAE
Score

10^/10

bazarloader dropper loader
- Bazar Loader
  Detected loader normally used to deploy BazarBackdoor malware.
  loader dropper bazarloader
- Bazarloader family
  bazarloader
- Bazar/Team9 Loader payload
- Blocklisted process makes network request
- Tries to connect to .bazar domain
  Attempts to lookup or connect to a .bazar domain, used by BazarBackdoor, Trickbot, and potentially others.
- Unexpected DNS network traffic destination
  Network traffic to other servers than the configured DNS servers was detected on the DNS port.
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

Subvert Trust Controls

Install Root Certificate

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

bazarloaderdropperloader

behavioral2

bazarloaderdropperloader

© 2018-2025

Terms | Privacy