Overview

overview

10

Static

static

3

b6d4e8dcff...4N.dll

windows7-x64

10

b6d4e8dcff...4N.dll

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    b6d4e8dcff91e58906943d58827e88c5373b61b5baa6cc8d9245c02b02b2eef4N.exe

  • Size

    825KB

  • Sample

    241128-v3e2fsvjaw

  • MD5

    c8fc52e18c7e89b622df27c9ca8bf300

  • SHA1

    4355e5d2af4a49b003b623d0ff05db559fe9f01d

  • SHA256

    b6d4e8dcff91e58906943d58827e88c5373b61b5baa6cc8d9245c02b02b2eef4

  • SHA512

    edfbe480559c91e7813985c702fd004a09d22c8636bce697f8faa0955eaeb4fd2b89019216f3fff7d4a982744a785f475e52b66c9e3cd0db3ffdc1bc55dfa928

  • SSDEEP

    12288:NafGVgqM7aafQIbyhxi5zhRSAofMvG9VWTY3DdWyS5EPGE:NafGVJwyAq+hfgAG9VWGdWyIE

Score
10/10
bazarloaderdropperloader

Malware Config

Targets

    • Target

      b6d4e8dcff91e58906943d58827e88c5373b61b5baa6cc8d9245c02b02b2eef4N.exe

    • Size

      825KB

    • MD5

      c8fc52e18c7e89b622df27c9ca8bf300

    • SHA1

      4355e5d2af4a49b003b623d0ff05db559fe9f01d

    • SHA256

      b6d4e8dcff91e58906943d58827e88c5373b61b5baa6cc8d9245c02b02b2eef4

    • SHA512

      edfbe480559c91e7813985c702fd004a09d22c8636bce697f8faa0955eaeb4fd2b89019216f3fff7d4a982744a785f475e52b66c9e3cd0db3ffdc1bc55dfa928

    • SSDEEP

      12288:NafGVgqM7aafQIbyhxi5zhRSAofMvG9VWTY3DdWyS5EPGE:NafGVJwyAq+hfgAG9VWGdWyIE

    Score
    10/10
    bazarloaderdropperloader

    • Bazar Loader

      Detected loader normally used to deploy BazarBackdoor malware.

      loaderdropperbazarloader

    • Bazarloader family

      bazarloader

    • Bazar/Team9 Loader payload

    • Tries to connect to .bazar domain

      Attempts to lookup or connect to a .bazar domain, used by BazarBackdoor, Trickbot, and potentially others.

    • Unexpected DNS network traffic destination

      Network traffic to other servers than the configured DNS servers was detected on the DNS port.

    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks