Overview

overview

10

Static

static

10

ec4f09f82d...d3.exe

windows10-2004-x64

10

ec4f09f82d...d3.exe

windows11-21h2-x64

10

efd97b1038...ea4.js

windows10-2004-x64

3

efd97b1038...ea4.js

windows11-21h2-x64

3

emotet_exe...04.exe

windows10-2004-x64

10

emotet_exe...04.exe

windows11-21h2-x64

10

emotet_exe...23.exe

windows10-2004-x64

10

emotet_exe...23.exe

windows11-21h2-x64

10

eupdate.exe

windows10-2004-x64

3

eupdate.exe

windows11-21h2-x64

7

f4f47c67be...3f.exe

windows10-2004-x64

10

f4f47c67be...3f.exe

windows11-21h2-x64

10

fb5d110ced...9c.exe

windows10-2004-x64

6

fb5d110ced...9c.exe

windows11-21h2-x64

6

fee15285c3...35.exe

windows10-2004-x64

10

fee15285c3...35.exe

windows11-21h2-x64

10

file(1).exe

windows10-2004-x64

1

file(1).exe

windows11-21h2-x64

1

file.exe

windows10-2004-x64

7

file.exe

windows11-21h2-x64

7

gjMEi6eG.exe

windows10-2004-x64

10

gjMEi6eG.exe

windows11-21h2-x64

10

good.exe

windows10-2004-x64

10

good.exe

windows11-21h2-x64

5

hyundai st...1).exe

windows10-2004-x64

10

hyundai st...1).exe

windows11-21h2-x64

10

hyundai st...10.exe

windows10-2004-x64

10

hyundai st...10.exe

windows11-21h2-x64

10

infected d...er.exe

windows10-2004-x64

10

infected d...er.exe

windows11-21h2-x64

10

inps_979.xls

windows10-2004-x64

1

inps_979.xls

windows11-21h2-x64

1

Resubmissions

09/09/2026, 14:50

260909-r7wcfsxbla

18/04/2026, 19:17

260418-xzvnvaez7p

14/03/2026, 14:12

260314-rhx5rahy6t

14/03/2026, 14:11

260314-rhch2shy4v

02/03/2026, 21:05

260302-zw5ezsaw4c

01/02/2026, 12:58

260201-p71aasfw8g

20/01/2026, 21:07

260120-zyjlasbt6a

17/01/2026, 21:43

260117-1kz7kadz8c

17/01/2026, 21:31

260117-1c6pdadx7b

15/01/2026, 13:29

260115-qq9yvah18c

Analysis

  • max time kernel
    149s
  • max time network
    155s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20251231-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20251231-enlocale:en-usos:windows10-2004-x64system
  • submitted
    10/01/2026, 15:59

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    f4f47c67be61d386e7d757ff89825fa630dd5cc4ed600b5471f9cc18c21e983f.exe
  • Size 332KB
  • Sample260110-te14caev5f
  • SHA256 f4f47c67be61d386e7d757ff89825fa630dd5cc4ed600b5471f9cc18c21e983f
  • MD5 SHA1 SHA512 SSDEEP
Score
10/10
backdoordropperbazarbackdoorbazarloaderloader

Malware Config

Signatures

  • Bazar Loader 64 IoCs

    Detected loader normally used to deploy BazarBackdoor malware.

    loaderdropperbazarloader
  • BazarBackdoor 64 IoCs

    Stealthy backdoor targeting corporate networks, believed to be developed by Trickbot's authors.

    backdoorbazarbackdoor
  • Bazarbackdoor family
    bazarbackdoor
  • Bazarloader family
    bazarloader
  • Tries to connect to .bazar domain 64 IoCs

    Attempts to lookup or connect to a .bazar domain, used by BazarBackdoor, Trickbot, and potentially others.

  • Unexpected DNS network traffic destination 64 IoCs

    Network traffic to other servers than the configured DNS servers was detected on the DNS port.

  • Looks up external IP address via web service 1 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

Processes

  • C:\Users\Admin\AppData\Local\Temp\f4f47c67be61d386e7d757ff89825fa630dd5cc4ed600b5471f9cc18c21e983f.exe
    "C:\Users\Admin\AppData\Local\Temp\f4f47c67be61d386e7d757ff89825fa630dd5cc4ed600b5471f9cc18c21e983f.exe"
    1⤵
    • Bazar Loader
    • BazarBackdoor
    • Unexpected DNS network traffic destination
    PID:5260

Network

        MITRE ATT&CK Matrix

        Replay Monitor

        Loading Replay Monitor...

        Downloads