Overview
overview
10Static
static
10ec4f09f82d...d3.exe
windows10-2004-x64
10ec4f09f82d...d3.exe
windows11-21h2-x64
10efd97b1038...ea4.js
windows10-2004-x64
3efd97b1038...ea4.js
windows11-21h2-x64
3emotet_exe...04.exe
windows10-2004-x64
10emotet_exe...04.exe
windows11-21h2-x64
10emotet_exe...23.exe
windows10-2004-x64
10emotet_exe...23.exe
windows11-21h2-x64
10eupdate.exe
windows10-2004-x64
3eupdate.exe
windows11-21h2-x64
7f4f47c67be...3f.exe
windows10-2004-x64
10f4f47c67be...3f.exe
windows11-21h2-x64
10fb5d110ced...9c.exe
windows10-2004-x64
6fb5d110ced...9c.exe
windows11-21h2-x64
6fee15285c3...35.exe
windows10-2004-x64
10fee15285c3...35.exe
windows11-21h2-x64
10file(1).exe
windows10-2004-x64
1file(1).exe
windows11-21h2-x64
1file.exe
windows10-2004-x64
7file.exe
windows11-21h2-x64
7gjMEi6eG.exe
windows10-2004-x64
10gjMEi6eG.exe
windows11-21h2-x64
10good.exe
windows10-2004-x64
10good.exe
windows11-21h2-x64
5hyundai st...1).exe
windows10-2004-x64
10hyundai st...1).exe
windows11-21h2-x64
10hyundai st...10.exe
windows10-2004-x64
10hyundai st...10.exe
windows11-21h2-x64
10infected d...er.exe
windows10-2004-x64
10infected d...er.exe
windows11-21h2-x64
10inps_979.xls
windows10-2004-x64
1inps_979.xls
windows11-21h2-x64
1Resubmissions
09/09/2026, 14:50
260909-r7wcfsxbla18/04/2026, 19:17
260418-xzvnvaez7p14/03/2026, 14:12
260314-rhx5rahy6t14/03/2026, 14:11
260314-rhch2shy4v02/03/2026, 21:05
260302-zw5ezsaw4c01/02/2026, 12:58
260201-p71aasfw8g20/01/2026, 21:07
260120-zyjlasbt6a17/01/2026, 21:43
260117-1kz7kadz8c17/01/2026, 21:31
260117-1c6pdadx7b15/01/2026, 13:29
260115-qq9yvah18cAnalysis
- max time kernel
149s - max time network
154s - platform
windows11-21h2_x64 - resource
win11-20251231-en - resource tags
arch:x64arch:x86image:win11-20251231-enlocale:en-usos:windows11-21h2-x64system - submitted
10/01/2026, 15:59
Static task
static1
Behavioral task
behavioral1
Sample
ec4f09f82d932cdd40700a74a8875b73a783cbaab1f313286adf615a5336d7d3.exe
Resource
win10v2004-20251231-en
windows10-2004-x64
Behavioral task
behavioral2
Sample
ec4f09f82d932cdd40700a74a8875b73a783cbaab1f313286adf615a5336d7d3.exe
Resource
win11-20251231-en
windows11-21h2-x64
Behavioral task
behavioral3
Sample
efd97b1038e063779fb32a3ab35adc481679a5c6c8e3f4f69c44987ff08b6ea4.js
Resource
win10v2004-20251231-en
windows10-2004-x64
Behavioral task
behavioral4
Sample
efd97b1038e063779fb32a3ab35adc481679a5c6c8e3f4f69c44987ff08b6ea4.js
Resource
win11-20251231-en
windows11-21h2-x64
Behavioral task
behavioral5
Sample
emotet_exe_e1_ef536781ae8be4b67a7fb8aa562d84994ad250d97d5606115b6f4e6e2992363f_2020-11-17__174504.exe
Resource
win10v2004-20251231-en
windows10-2004-x64
Behavioral task
behavioral6
Sample
emotet_exe_e1_ef536781ae8be4b67a7fb8aa562d84994ad250d97d5606115b6f4e6e2992363f_2020-11-17__174504.exe
Resource
win11-20251231-en
windows11-21h2-x64
Behavioral task
behavioral7
Sample
emotet_exe_e3_93074e9fbde60e4182f5d763bac7762f2d4e2fcf9baf457b6f12e7696b3562c1_2020-11-17__182823.exe
Resource
win10v2004-20251231-en
windows10-2004-x64
Behavioral task
behavioral8
Sample
emotet_exe_e3_93074e9fbde60e4182f5d763bac7762f2d4e2fcf9baf457b6f12e7696b3562c1_2020-11-17__182823.exe
Resource
win11-20251231-en
windows11-21h2-x64
Behavioral task
behavioral9
Sample
eupdate.exe
Resource
win10v2004-20251231-en
windows10-2004-x64
Behavioral task
behavioral10
Sample
eupdate.exe
Resource
win11-20251231-en
windows11-21h2-x64
Behavioral task
behavioral11
Sample
f4f47c67be61d386e7d757ff89825fa630dd5cc4ed600b5471f9cc18c21e983f.exe
Resource
win10v2004-20251231-en
windows10-2004-x64
Behavioral task
behavioral12
Sample
f4f47c67be61d386e7d757ff89825fa630dd5cc4ed600b5471f9cc18c21e983f.exe
Resource
win11-20251231-en
windows11-21h2-x64
Behavioral task
behavioral13
Sample
fb5d110ced698b06c6cb8c7112792a2d37c579dcd9bde808310cb8dc88e16d9c.exe
Resource
win10v2004-20251231-en
windows10-2004-x64
Behavioral task
behavioral14
Sample
fb5d110ced698b06c6cb8c7112792a2d37c579dcd9bde808310cb8dc88e16d9c.exe
Resource
win11-20251231-en
windows11-21h2-x64
Behavioral task
behavioral15
Sample
fee15285c36fa7e28e28c7bb9b4cd3940ef12b9907de59d11ab6e2376416d35.exe
Resource
win10v2004-20251231-en
windows10-2004-x64
Behavioral task
behavioral16
Sample
fee15285c36fa7e28e28c7bb9b4cd3940ef12b9907de59d11ab6e2376416d35.exe
Resource
win11-20251231-en
windows11-21h2-x64
Behavioral task
behavioral17
Sample
file(1).exe
Resource
win10v2004-20251231-en
windows10-2004-x64
Behavioral task
behavioral18
Sample
file(1).exe
Resource
win11-20251229-en
windows11-21h2-x64
Behavioral task
behavioral19
Sample
file.exe
Resource
win10v2004-20251231-en
windows10-2004-x64
Behavioral task
behavioral20
Sample
file.exe
Resource
win11-20251229-en
windows11-21h2-x64
Behavioral task
behavioral21
Sample
gjMEi6eG.exe
Resource
win10v2004-20251231-en
windows10-2004-x64
Behavioral task
behavioral22
Sample
gjMEi6eG.exe
Resource
win11-20251231-en
windows11-21h2-x64
Behavioral task
behavioral23
Sample
good.exe
Resource
win10v2004-20251231-en
windows10-2004-x64
Behavioral task
behavioral24
Sample
good.exe
Resource
win11-20251231-en
windows11-21h2-x64
Behavioral task
behavioral25
Sample
hyundai steel-pipe- job 8010(1).exe
Resource
win10v2004-20251231-en
windows10-2004-x64
Behavioral task
behavioral26
Sample
hyundai steel-pipe- job 8010(1).exe
Resource
win11-20251231-en
windows11-21h2-x64
Behavioral task
behavioral27
Sample
hyundai steel-pipe- job 8010.exe
Resource
win10v2004-20251231-en
windows10-2004-x64
Behavioral task
behavioral28
Sample
hyundai steel-pipe- job 8010.exe
Resource
win11-20251231-en
windows11-21h2-x64
Behavioral task
behavioral29
Sample
infected dot net installer.exe
Resource
win10v2004-20251231-en
windows10-2004-x64
Behavioral task
behavioral30
Sample
infected dot net installer.exe
Resource
win11-20251231-en
windows11-21h2-x64
Behavioral task
behavioral31
Sample
inps_979.xls
Resource
win10v2004-20251231-en
windows10-2004-x64
Behavioral task
behavioral32
Sample
inps_979.xls
Resource
win11-20251231-en
windows11-21h2-x64
General
- Target f4f47c67be61d386e7d757ff89825fa630dd5cc4ed600b5471f9cc18c21e983f.exe
- Size 332KB
- Sample260110-te14caev5f
- SHA256 f4f47c67be61d386e7d757ff89825fa630dd5cc4ed600b5471f9cc18c21e983f
- MD5 1e0ff1a8078820c5c10652e406d51bef
- SHA1 e191fdbe58b527301eb4bd244a2258ba1cad0182
- SHA512 eb1a011724b988362aa52bdcb69d2886b736dbbe72fe9e53fa3530eeec6bb4089519896a88af48df8e99c7010930fb84cd33599e57f8477e8748cf5259e428a0
- SSDEEP 6144:R+xWEy53Bhj8sW4y9wTeT10hFPascnojIXTvUv7ohqfp2:RSw53Bhj8sW4ya6T6hFPasco4cv7o7
- MD5 SHA1 SHA512 SSDEEP
Malware Config
Signatures
- BazarBackdoor 64 IoCs
Stealthy backdoor targeting corporate networks, believed to be developed by Trickbot's authors.
description flow ioc Process 12 younika-hayde.bazar Process not Found 20 younika-hayde.bazar Process not Found 48 younika-hayde.bazar Process not Found 62 younika-hayde.bazar Process not Found Key created \REGISTRY\MACHINE\Software\Microsoft\SystemCertificates\Root f4f47c67be61d386e7d757ff89825fa630dd5cc4ed600b5471f9cc18c21e983f.exe 14 younika-hayde.bazar Process not Found 27 younika-hayde.bazar Process not Found 41 younika-hayde.bazar Process not Found 52 younika-hayde.bazar Process not Found 59 younika-hayde.bazar Process not Found 73 younika-hayde.bazar Process not Found 15 younika-hayde.bazar Process not Found 21 younika-hayde.bazar Process not Found 55 younika-hayde.bazar Process not Found 78 younika-hayde.bazar Process not Found 10 younika-hayde.bazar Process not Found 37 younika-hayde.bazar Process not Found 38 younika-hayde.bazar Process not Found 64 younika-hayde.bazar Process not Found 11 younika-hayde.bazar Process not Found 19 younika-hayde.bazar Process not Found 57 younika-hayde.bazar Process not Found 30 younika-hayde.bazar Process not Found 13 younika-hayde.bazar Process not Found 31 younika-hayde.bazar Process not Found 50 younika-hayde.bazar Process not Found 72 younika-hayde.bazar Process not Found 33 younika-hayde.bazar Process not Found 36 younika-hayde.bazar Process not Found 63 younika-hayde.bazar Process not Found 25 younika-hayde.bazar Process not Found 70 younika-hayde.bazar Process not Found 16 younika-hayde.bazar Process not Found 18 younika-hayde.bazar Process not Found 26 younika-hayde.bazar Process not Found 39 younika-hayde.bazar Process not Found 40 younika-hayde.bazar Process not Found 43 younika-hayde.bazar Process not Found 79 younika-hayde.bazar Process not Found 17 younika-hayde.bazar Process not Found 24 younika-hayde.bazar Process not Found 44 younika-hayde.bazar Process not Found 54 younika-hayde.bazar Process not Found 69 younika-hayde.bazar Process not Found 22 younika-hayde.bazar Process not Found 75 younika-hayde.bazar Process not Found 76 younika-hayde.bazar Process not Found 29 younika-hayde.bazar Process not Found 49 younika-hayde.bazar Process not Found 53 younika-hayde.bazar Process not Found 58 younika-hayde.bazar Process not Found 60 younika-hayde.bazar Process not Found 65 younika-hayde.bazar Process not Found 74 younika-hayde.bazar Process not Found 35 younika-hayde.bazar Process not Found 34 younika-hayde.bazar Process not Found 42 younika-hayde.bazar Process not Found 46 younika-hayde.bazar Process not Found 47 younika-hayde.bazar Process not Found 56 younika-hayde.bazar Process not Found 61 younika-hayde.bazar Process not Found 71 younika-hayde.bazar Process not Found 23 younika-hayde.bazar Process not Found 32 younika-hayde.bazar Process not Found - Bazarbackdoor family
- Tries to connect to .bazar domain 64 IoCs
Attempts to lookup or connect to a .bazar domain, used by BazarBackdoor, Trickbot, and potentially others.
flow ioc 36 younika-hayde.bazar 38 younika-hayde.bazar 69 younika-hayde.bazar 72 younika-hayde.bazar 27 younika-hayde.bazar 45 younika-hayde.bazar 51 younika-hayde.bazar 79 younika-hayde.bazar 29 younika-hayde.bazar 44 younika-hayde.bazar 71 younika-hayde.bazar 10 younika-hayde.bazar 15 younika-hayde.bazar 24 younika-hayde.bazar 25 younika-hayde.bazar 32 younika-hayde.bazar 42 younika-hayde.bazar 46 younika-hayde.bazar 49 younika-hayde.bazar 20 younika-hayde.bazar 31 younika-hayde.bazar 47 younika-hayde.bazar 53 younika-hayde.bazar 55 younika-hayde.bazar 57 younika-hayde.bazar 63 younika-hayde.bazar 64 younika-hayde.bazar 67 younika-hayde.bazar 14 younika-hayde.bazar 35 younika-hayde.bazar 75 younika-hayde.bazar 22 younika-hayde.bazar 40 younika-hayde.bazar 41 younika-hayde.bazar 50 younika-hayde.bazar 62 younika-hayde.bazar 73 younika-hayde.bazar 76 younika-hayde.bazar 78 younika-hayde.bazar 18 younika-hayde.bazar 23 younika-hayde.bazar 58 younika-hayde.bazar 12 younika-hayde.bazar 21 younika-hayde.bazar 54 younika-hayde.bazar 68 younika-hayde.bazar 37 younika-hayde.bazar 11 younika-hayde.bazar 17 younika-hayde.bazar 19 younika-hayde.bazar 59 younika-hayde.bazar 70 younika-hayde.bazar 77 younika-hayde.bazar 16 younika-hayde.bazar 56 younika-hayde.bazar 13 younika-hayde.bazar 34 younika-hayde.bazar 60 younika-hayde.bazar 28 younika-hayde.bazar 39 younika-hayde.bazar 43 younika-hayde.bazar 48 younika-hayde.bazar 61 younika-hayde.bazar 66 younika-hayde.bazar - Unexpected DNS network traffic destination 64 IoCs
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
description flow ioc pid Process Destination IP 69 66.70.211.246 5048 f4f47c67be61d386e7d757ff89825fa630dd5cc4ed600b5471f9cc18c21e983f.exe Destination IP 22 158.69.239.167 5048 f4f47c67be61d386e7d757ff89825fa630dd5cc4ed600b5471f9cc18c21e983f.exe Destination IP 30 82.141.39.32 5048 f4f47c67be61d386e7d757ff89825fa630dd5cc4ed600b5471f9cc18c21e983f.exe Destination IP 38 45.71.112.70 5048 f4f47c67be61d386e7d757ff89825fa630dd5cc4ed600b5471f9cc18c21e983f.exe Destination IP 61 91.217.137.37 5048 f4f47c67be61d386e7d757ff89825fa630dd5cc4ed600b5471f9cc18c21e983f.exe Destination IP 66 185.164.136.225 5048 f4f47c67be61d386e7d757ff89825fa630dd5cc4ed600b5471f9cc18c21e983f.exe Destination IP 19 163.53.248.170 5048 f4f47c67be61d386e7d757ff89825fa630dd5cc4ed600b5471f9cc18c21e983f.exe Destination IP 21 142.4.205.47 5048 f4f47c67be61d386e7d757ff89825fa630dd5cc4ed600b5471f9cc18c21e983f.exe Destination IP 31 50.3.82.215 5048 f4f47c67be61d386e7d757ff89825fa630dd5cc4ed600b5471f9cc18c21e983f.exe Destination IP 59 89.18.27.167 5048 f4f47c67be61d386e7d757ff89825fa630dd5cc4ed600b5471f9cc18c21e983f.exe Destination IP 73 35.196.105.24 5048 f4f47c67be61d386e7d757ff89825fa630dd5cc4ed600b5471f9cc18c21e983f.exe Destination IP 12 91.217.137.37 5048 f4f47c67be61d386e7d757ff89825fa630dd5cc4ed600b5471f9cc18c21e983f.exe Destination IP 23 104.37.195.178 5048 f4f47c67be61d386e7d757ff89825fa630dd5cc4ed600b5471f9cc18c21e983f.exe Destination IP 44 147.135.185.78 5048 f4f47c67be61d386e7d757ff89825fa630dd5cc4ed600b5471f9cc18c21e983f.exe Destination IP 15 169.239.202.202 5048 f4f47c67be61d386e7d757ff89825fa630dd5cc4ed600b5471f9cc18c21e983f.exe Destination IP 25 158.69.160.164 5048 f4f47c67be61d386e7d757ff89825fa630dd5cc4ed600b5471f9cc18c21e983f.exe Destination IP 54 178.17.170.179 5048 f4f47c67be61d386e7d757ff89825fa630dd5cc4ed600b5471f9cc18c21e983f.exe Destination IP 72 128.52.130.209 5048 f4f47c67be61d386e7d757ff89825fa630dd5cc4ed600b5471f9cc18c21e983f.exe Destination IP 64 139.99.96.146 5048 f4f47c67be61d386e7d757ff89825fa630dd5cc4ed600b5471f9cc18c21e983f.exe Destination IP 35 144.76.133.38 5048 f4f47c67be61d386e7d757ff89825fa630dd5cc4ed600b5471f9cc18c21e983f.exe Destination IP 47 159.89.249.249 5048 f4f47c67be61d386e7d757ff89825fa630dd5cc4ed600b5471f9cc18c21e983f.exe Destination IP 49 139.59.23.241 5048 f4f47c67be61d386e7d757ff89825fa630dd5cc4ed600b5471f9cc18c21e983f.exe Destination IP 57 146.185.176.36 5048 f4f47c67be61d386e7d757ff89825fa630dd5cc4ed600b5471f9cc18c21e983f.exe Destination IP 77 167.99.153.82 5048 f4f47c67be61d386e7d757ff89825fa630dd5cc4ed600b5471f9cc18c21e983f.exe Destination IP 45 92.222.97.145 5048 f4f47c67be61d386e7d757ff89825fa630dd5cc4ed600b5471f9cc18c21e983f.exe Destination IP 52 45.63.124.65 5048 f4f47c67be61d386e7d757ff89825fa630dd5cc4ed600b5471f9cc18c21e983f.exe Destination IP 13 87.98.175.85 5048 f4f47c67be61d386e7d757ff89825fa630dd5cc4ed600b5471f9cc18c21e983f.exe Destination IP 14 185.121.177.177 5048 f4f47c67be61d386e7d757ff89825fa630dd5cc4ed600b5471f9cc18c21e983f.exe Destination IP 24 192.99.85.244 5048 f4f47c67be61d386e7d757ff89825fa630dd5cc4ed600b5471f9cc18c21e983f.exe Destination IP 32 46.101.70.183 5048 f4f47c67be61d386e7d757ff89825fa630dd5cc4ed600b5471f9cc18c21e983f.exe Destination IP 34 130.255.78.223 5048 f4f47c67be61d386e7d757ff89825fa630dd5cc4ed600b5471f9cc18c21e983f.exe Destination IP 65 217.12.210.54 5048 f4f47c67be61d386e7d757ff89825fa630dd5cc4ed600b5471f9cc18c21e983f.exe Destination IP 68 63.231.92.27 5048 f4f47c67be61d386e7d757ff89825fa630dd5cc4ed600b5471f9cc18c21e983f.exe Destination IP 71 45.32.160.206 5048 f4f47c67be61d386e7d757ff89825fa630dd5cc4ed600b5471f9cc18c21e983f.exe Destination IP 27 31.171.251.118 5048 f4f47c67be61d386e7d757ff89825fa630dd5cc4ed600b5471f9cc18c21e983f.exe Destination IP 46 51.255.211.146 5048 f4f47c67be61d386e7d757ff89825fa630dd5cc4ed600b5471f9cc18c21e983f.exe Destination IP 50 193.183.98.66 5048 f4f47c67be61d386e7d757ff89825fa630dd5cc4ed600b5471f9cc18c21e983f.exe Destination IP 78 138.197.25.214 5048 f4f47c67be61d386e7d757ff89825fa630dd5cc4ed600b5471f9cc18c21e983f.exe Destination IP 10 51.254.25.115 5048 f4f47c67be61d386e7d757ff89825fa630dd5cc4ed600b5471f9cc18c21e983f.exe Destination IP 18 111.67.20.8 5048 f4f47c67be61d386e7d757ff89825fa630dd5cc4ed600b5471f9cc18c21e983f.exe Destination IP 40 87.98.175.85 5048 f4f47c67be61d386e7d757ff89825fa630dd5cc4ed600b5471f9cc18c21e983f.exe Destination IP 48 104.238.186.189 5048 f4f47c67be61d386e7d757ff89825fa630dd5cc4ed600b5471f9cc18c21e983f.exe Destination IP 33 5.45.97.127 5048 f4f47c67be61d386e7d757ff89825fa630dd5cc4ed600b5471f9cc18c21e983f.exe Destination IP 39 163.172.185.51 5048 f4f47c67be61d386e7d757ff89825fa630dd5cc4ed600b5471f9cc18c21e983f.exe Destination IP 55 185.208.208.141 5048 f4f47c67be61d386e7d757ff89825fa630dd5cc4ed600b5471f9cc18c21e983f.exe Destination IP 42 51.255.48.78 5048 f4f47c67be61d386e7d757ff89825fa630dd5cc4ed600b5471f9cc18c21e983f.exe Destination IP 63 176.126.70.119 5048 f4f47c67be61d386e7d757ff89825fa630dd5cc4ed600b5471f9cc18c21e983f.exe Destination IP 76 107.172.42.186 5048 f4f47c67be61d386e7d757ff89825fa630dd5cc4ed600b5471f9cc18c21e983f.exe Destination IP 11 193.183.98.66 5048 f4f47c67be61d386e7d757ff89825fa630dd5cc4ed600b5471f9cc18c21e983f.exe Destination IP 16 198.251.90.143 5048 f4f47c67be61d386e7d757ff89825fa630dd5cc4ed600b5471f9cc18c21e983f.exe Destination IP 17 5.132.191.104 5048 f4f47c67be61d386e7d757ff89825fa630dd5cc4ed600b5471f9cc18c21e983f.exe Destination IP 29 51.254.25.115 5048 f4f47c67be61d386e7d757ff89825fa630dd5cc4ed600b5471f9cc18c21e983f.exe Destination IP 41 5.135.183.146 5048 f4f47c67be61d386e7d757ff89825fa630dd5cc4ed600b5471f9cc18c21e983f.exe Destination IP 43 188.165.200.156 5048 f4f47c67be61d386e7d757ff89825fa630dd5cc4ed600b5471f9cc18c21e983f.exe Destination IP 58 89.35.39.64 5048 f4f47c67be61d386e7d757ff89825fa630dd5cc4ed600b5471f9cc18c21e983f.exe Destination IP 26 46.28.207.199 5048 f4f47c67be61d386e7d757ff89825fa630dd5cc4ed600b5471f9cc18c21e983f.exe Destination IP 28 81.2.241.148 5048 f4f47c67be61d386e7d757ff89825fa630dd5cc4ed600b5471f9cc18c21e983f.exe Destination IP 70 96.47.228.108 5048 f4f47c67be61d386e7d757ff89825fa630dd5cc4ed600b5471f9cc18c21e983f.exe Destination IP 75 162.248.241.94 5048 f4f47c67be61d386e7d757ff89825fa630dd5cc4ed600b5471f9cc18c21e983f.exe Destination IP 56 82.196.9.45 5048 f4f47c67be61d386e7d757ff89825fa630dd5cc4ed600b5471f9cc18c21e983f.exe Destination IP 60 77.73.68.161 5048 f4f47c67be61d386e7d757ff89825fa630dd5cc4ed600b5471f9cc18c21e983f.exe Destination IP 67 192.52.166.110 5048 f4f47c67be61d386e7d757ff89825fa630dd5cc4ed600b5471f9cc18c21e983f.exe Destination IP 74 172.98.193.42 5048 f4f47c67be61d386e7d757ff89825fa630dd5cc4ed600b5471f9cc18c21e983f.exe Destination IP 79 69.164.196.21 5048 f4f47c67be61d386e7d757ff89825fa630dd5cc4ed600b5471f9cc18c21e983f.exe - Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
description flow ioc HTTP URL 9 https://api.opennicproject.org/geoip/