malware_traffic

2020-09-15 - BazarLoader malware from Google Docs page

Sep 15th, 2020 (edited)
788
Never
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
  1. 2020-09-15 - BAZARLOADER MALWARE FROM GOOGLE DOCS PAGE
  2.  
  3. REFERENCE:
  4.  
  5. - https://twitter.com/malware_traffic/status/1305970293253574661
  6.  
  7. NOTE:
  8.  
  9. - A link to this Google Docs page was likely sent through malspam.
  10.  
  11. GOOGLE DOCS URL FOR DOWNLOAD PAGE:
  12.  
  13. - hxxps://docs.google[.]com/document/d/e/2PACX-1vT-goZJung2xJeUM9yzqTqRV8oSbrbFaGr23IwyInIPyNL7HUBBetwB7y5FQehfNU_mg1wWHhP2ceeT/pub
  14.  
  15. EXAMPLES OF URLS FROM THE DOWNLOAD PAGE:
  16.  
  17. - hxxps://www.google[.]com/url?q=hxxps://unitedyfl[.]com/Print_Preview.exe&sa=D&ust=1600182579826000&usg=AOvVaw2eIp2TcrA_2xIkQMxOmL74
  18.  
  19. - hxxps://www.google[.]com/url?q=hxxps://rayanat[.]com/Print_Preview.exe&sa=D&ust=1600194315747000&usg=AOvVaw30078SJ1v2wGq_FLGpEAbf
  20.  
  21. - hxxps://www.google[.]com/url?q=hxxps://calacatta[.]com/Preview.exe&sa=D&ust=1600203326242000&usg=AOvVaw1BN3mdAtVWqS3An8X-Vy9L
  22.  
  23. BAZARLOADER SAMPLES:
  24.  
  25. - SHA256 hash: 34cc67888cd38da7aeb52508b48ad71287c402aecb72bccca7cbd3a0cd8fe985
  26. - File size: 257,208 bytes
  27. - File location: hxxps://unitedyfl[.]com/Print_Preview.exe
  28. - Sandbox analysis: https://app.any.run/tasks/975fb69c-b5eb-49c7-8d8f-332d34b6f46b/
  29.  
  30. - SHA256 hash: 09557d538aee094d168a4b4fb5174d742fe81dd59dd27e2eee078fb3f10d9017
  31. - File size: 582,840 bytes
  32. - File location: hxxps://rayanat[.]com/Print_Preview[.]exe
  33. - Sandbox analysis: https://app.any.run/tasks/d0b1de23-ac5a-4274-afa0-4066fcb51844/
  34.  
  35. - SHA256 hash: 18fe9ceab0a17ddc71f7b7a206c1c127d62a0a86c62573b8c018ab562da1fd6e
  36. - File size: 257,208 bytes
  37. - File location: hxxps://calacatta[.]com/Preview.exe
  38. - Sandbox analysis: https://app.any.run/tasks/b21c7dbe-7a74-48d3-9762-874c3c80c9e0/
  39.  
RAW Paste Data