6f2e3eccadffadc1b7d610246816b9906c6cb5d50d1876dcd588364241a46200

General

Target
bazzarnuker.exe
Size 179KB
Sample260628-a8k5faex2x
SHA256 6f2e3eccadffadc1b7d610246816b9906c6cb5d50d1876dcd588364241a46200
MD5 09b9bf77adc7642fd85454061928f6f5
SHA1 331b93ce08ce83ba6ba4fb4477332ff017d6307d
SHA512 9c6c63362183e72aa424a449880141f068534ff5f00c41af1bd93fd39ca096a059dd246866b67978acba1ac5c135d92341d57d5edfbf9c0807582d735ab24ef4
SSDEEP 3072:0+bTQ3ggu0qPd+RLXnanGnrHzdyEfurHOTWOnUi6XrSq4BOps6aFG:0+0gYR7angH0HgmBSqsOK8
TLSH
T1FB04237680EAC758EFB30971C1BC546FA2551C3FB7F06B7F10D63B260BC86245A25922
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  bazzarnuker.exe
- Size 179KB
- SHA256 6f2e3eccadffadc1b7d610246816b9906c6cb5d50d1876dcd588364241a46200
- MD5 09b9bf77adc7642fd85454061928f6f5
- SHA1 331b93ce08ce83ba6ba4fb4477332ff017d6307d
- SHA512 9c6c63362183e72aa424a449880141f068534ff5f00c41af1bd93fd39ca096a059dd246866b67978acba1ac5c135d92341d57d5edfbf9c0807582d735ab24ef4
- SSDEEP 3072:0+bTQ3ggu0qPd+RLXnanGnrHzdyEfurHOTWOnUi6XrSq4BOps6aFG:0+0gYR7angH0HgmBSqsOK8
- TLSH
  T1FB04237680EAC758EFB30971C1BC546FA2551C3FB7F06B7F10D63B260BC86245A25922
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

bootkit credential_access defense_evasion discovery evasion execution impact persistence ransomware spyware stealer trojan upx
- Modifies Windows Defender DisableAntiSpyware settings
  evasion trojan
- Modifies Windows Defender Real-time Protection settings
  defense_evasion trojan
- Clears Windows event logs
  defense_evasion ransomware
- Deletes shadow copies
  Ransomware often targets backup files to inhibit system recovery.
  ransomware defense_evasion impact execution
- Command and Scripting Interpreter: PowerShell
  Run Powershell and hide display window.
  execution
- Credentials from Password Stores: Windows Credential Manager
  Suspicious access to Credentials History.
  credential_access stealer
- Disables service(s)
  defense_evasion execution
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Stops running service(s)
  defense_evasion execution
- Writes to the Master Boot Record (MBR)
  Bootkits write to the MBR to gain persistence at a level below the operating system.
  bootkit persistence
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral1 behavioral2