MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 d04bdbff24b1bed41536664bb9696387fc6e88756efa76ecf345937e7cfa014d. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


BazaLoader


Vendor detections: 6


Intelligence 6 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: d04bdbff24b1bed41536664bb9696387fc6e88756efa76ecf345937e7cfa014d
SHA3-384 hash: 3cf6318d06c955b9f5e18915f689787d0c836f90941b5cc6fcb3b19760835ca3381a207e70c8961a969cfb7ed861eabe
SHA1 hash: 9d7c786ed5b2d6c3d1dd9ae1dde9885ecba23514
MD5 hash: f2a47107c43371eca44ad9d76d18ba09
humanhash: equal-edward-idaho-monkey
File name:F2A47107C43371ECA44AD9D76D18BA09.bin
Download: download sample
Signature BazaLoader
Create hunting rule
File size:299'696 bytes
First seen:2020-06-22 07:21:40 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash 9ecf702fbe39bfec8abdf052311d634f (3 x BazaLoader)
ssdeep 6144:xwO9Ovf/iwTZ84rl+ETV3F5BwHGEWYgWOt4ps+2J9qUQAlm:xHa3iI+oj5BwHDWY3O+p6/qJ
Threatray 250 similar samples on MalwareBazaar
TLSH 6554BE3F339428BDDCA76130C9F18546F772742D9339934E07944E6B6E336A1AD2A722
Reporter JAMESWT_WT
Tags:BazaLoader

Code Signing Certificate

Organisation:DigiCert High Assurance EV Root CA
Issuer:DigiCert High Assurance EV Root CA
Algorithm:sha1WithRSAEncryption
Valid from:Nov 10 00:00:00 2006 GMT
Valid to:Nov 10 00:00:00 2031 GMT
Serial number: 02AC5C266A0B409B8F0B79F2AE462577
Intelligence: 204 malware samples on MalwareBazaar are signed with this code signing certificate
Thumbprint Algorithm:SHA256
Thumbprint: 7431E5F4C3C1CE4690774F0B61E05440883BA9A01ED00BA6ABD7806ED3B118CF
Source:This information was brought to you by ReversingLabs A1000 Malware Analysis Platform

Intelligence

File Origin
# of uploads :
1
# of downloads :
92
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/12420/
Detection(s):
PUA.Win.Downloader.Aiis-6803892-0
Create hunting rule

Result
Threat name:
Unknown
Detection:
malicious
Classification:
evad
Score:
88 / 100
Link:
https://www.joesandbox.com/analysis/375184
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 239684 Sample: Preview_Report.exe Startdate: 18/06/2020 Architecture: WINDOWS Score: 88 37 Snort IDS alert for network traffic (e.g. based on Emerging Threat rules) 2->37 39 Multi AV Scanner detection for domain / URL 2->39 41 Multi AV Scanner detection for submitted file 2->41 6 Preview_Report.exe 7 2->6         started        10 Preview_Report.exe 6 2->10         started        12 Preview_Report.exe 5 2->12         started        process3 dnsIp4 25 85.204.116.149, 443, 49717, 49718 unknown Romania 6->25 43 Creates an undocumented autostart registry key 6->43 45 Sets debug register (to hijack the execution of another thread) 6->45 47 Writes to foreign memory regions 6->47 14 cmd.exe 26 6->14         started        17 conhost.exe 6->17         started        27 217.12.209.60, 443, 49728, 49731 unknown Ukraine 10->27 29 185.65.202.58, 443 unknown Russian Federation 10->29 49 Allocates memory in foreign processes 10->49 51 Modifies the context of a thread in another process (thread injection) 10->51 53 Injects a PE file into a foreign processes 10->53 19 conhost.exe 10->19         started        21 cmd.exe 10->21         started        23 conhost.exe 1 12->23         started        signatures5 process6 dnsIp7 31 62.108.35.221, 443, 49730, 49734 unknown Germany 14->31 33 194.5.250.184, 443 unknown Romania 14->33 35 62.108.35.175, 443 unknown Germany 14->35
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/d04bdbff24b1bed41536664bb9696387fc6e88756efa76ecf345937e7cfa014d/
Threat name:
Win64.Trojan.TrickBot
Create hunting rule
Status:
Malicious
First seen:
2020-06-18 05:48:42 UTC
File Type:
PE+ (Exe)
Extracted files:
1
AV detection:
22 of 29 (75.86%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=2bf5x7zewg7nifjwmzf3s2ldq76g5cdvn35hn3htiwjx47h2afgq._file
Verdict:
malicious
Similar samples:
04ad133967d2076e4ce4cbd04c058ba7e8e3725fb72102e2b1b5de433f44de33
BazaLoader
467c33cb979804dad154612a808f2ea234f7501f8d36bf610ed457cc48993c49
BazaLoader
54c3e01a3dee75c7137c63a25915b7bec1876a8fc65047eff99b97d9ca6cd5c6
BazaLoader
6b24ebfb84665cb844410ec9f948cfcf7f6d08f4ede16d52930c53236390848f
BazaLoader
6f6351e0d8ebf90dc864996ebce30e60e8887f8c7f477fc3bec23806a1def95c
BazaLoader
7f757770f2049c23624a483feb6e9331693ded0dafb9c636f96fe6b9307a704c
BazaLoader
b4b7f0fd63cda1269ee937fa398fb80b6655d205066e6593fefceda7e3b09f6b
BazaLoader
e77e27630277a31276539c379671f54095d6b735f0568a3c457ac6a189c4c5b4
BazaLoader
e92d50b6632c11ff8cc4e0d478a1f647c060a97bd9206fb3ae6089104f2e495d
BazaLoader
f6cddc2f46ec3e8dc95b6fe42c6f30745bf0e7d3e9788c35a96199c82fc04f66
BazaLoader
+ 240 additional samples on MalwareBazaar
Result
Malware family:
bazarbackdoor
Create hunting rule
Score:
  10/10
Tags:
backdoor family:bazarbackdoor
Link:
https://tria.ge/reports/200624-me91js6x5j/
Behaviour
BazarBackdoor
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/12420/

Comments