MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 1eba154cdc2e540704eebfaca2f51fb643c44129911eb9b668f82ab95c1b157d. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

BazarCall

Vendor detections: 7

Intelligence 7 IOCs YARA 2 File information Comments

SHA256 hash:	1eba154cdc2e540704eebfaca2f51fb643c44129911eb9b668f82ab95c1b157d
SHA3-384 hash:	744a7d8d3f016fa7f08752be63bf97125b53456c5dbf66509cc97d31be492d0d5e1a3043c7af3e77ced9a8036da6f862
SHA1 hash:	d18bdf0200be5448619d19d2eb492755f0b56e05
MD5 hash:	98aca6c94ef680b24885d1462ccc36af
humanhash:	helium-april-kansas-connecticut
File name:	98aca6c94ef680b24885d1462ccc36af.exe
Download:	download sample
Signature	BazarCall Create hunting rule
File size:	1'128'864 bytes
First seen:	2021-03-24 07:42:43 UTC
Last seen:	2021-04-01 03:27:08 UTC
File type:	exe
MIME type:	application/x-dosexec
imphash	e6cc073c49124b726752da491045a2c7 (4 x BazarCall)
ssdeep	12288:dhRFcgwE8w1vM2CvWYPtZvM2CvWYPtFvM2CvWYPtFvM2CvWYPtFvM2CvWYPtFvMD:jcbwGXPtKXPtWXPtWXPtWXPtWXPtb
Threatray	6 similar samples on MalwareBazaar
TLSH	6835AE7721C40AF8E5B351309E7A6926CFF779490A23CA0F4E483408AB725E59B5DFE1
Reporter	abuse_ch
Tags:	BazarCall exe

Intelligence

File Origin

# of uploads :

# of downloads :

155

Origin country :

n/a

Vendor Threat Intelligence

Malware family:

n/a

ID:

File name:

98aca6c94ef680b24885d1462ccc36af.exe

Verdict:

No threats detected

Analysis date:

2021-03-24 08:00:24 UTC

Tags:

n/a

Link:

https://app.any.run/tasks/c0cc37c6-a2e7-4450-a299-2ebc3559bf20

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

Detection(s):

SecuriteInfo.com.generic.ml.6452.18752.UNOFFICIAL

Result

Verdict:

Malware

Maliciousness:

Behaviour

Transferring files using the Background Intelligent Transfer Service (BITS)

Sending a custom TCP request

Sending a UDP request

Launching a process

Unauthorized injection to a recently created process

Unauthorized injection to a recently created process by context flags manipulation

Result

Verdict:

MALICIOUS

Details

Windows PE Executable

Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.

Result

Threat name:

Unknown

Detection:

malicious

Classification:

evad

Score:

80 / 100

Link:

https://www.joesandbox.com/analysis/651778

Signature

Allocates memory in foreign processes

Injects a PE file into a foreign processes

Modifies the context of a thread in another process (thread injection)

Multi AV Scanner detection for submitted file

Sample uses process hollowing technique

Sets debug register (to hijack the execution of another thread)

Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)

Writes to foreign memory regions

Behaviour

Behavior Graph:

Download SVG

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/1eba154cdc2e540704eebfaca2f51fb643c44129911eb9b668f82ab95c1b157d/

Threat name:

Win64.Trojan.Bazar

Status:

Malicious

First seen:

2021-03-24 00:06:36 UTC

AV detection:

9 of 29 (31.03%)

Threat level:

5/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=d25bktg4fzkaobhox6wkf5i7wzb4iqjjsepltnti7avlsxa3cv6q._file

Verdict:

suspicious

BazarCall

4435942b9f09846a337474f396fd0a885f41742f05899dcc1a12b6b44a31126b

BazarCall

911d3b7d0ad2b9408ca63c381a73f38b15019954d4ff6ffe3fcac8f716c2a200

BazarCall

98cbdd45b45679061e3a3741cc2a32ef8abbc599de118a4604cff54b528cdaf3

BazarCall

cac07a4582d65b74322168e6aed9d7fd05e59e335fb7d1cdb7b5f7149a07d3eb

BazarCall

eb1eb139750b9e73d8d27448b93f9a3c0931f50572cd95282e9f205a0caa7e79

BazarCall

Result

Malware family:

n/a

Score:

8/10

Tags:

n/a

Link:

https://tria.ge/reports/210324-1g628fy826/

Behaviour

Modifies system certificate store

Looks up external IP address via web service

Tries to connect to .bazar domain

Unpacked files

SH256 hash:

1eba154cdc2e540704eebfaca2f51fb643c44129911eb9b668f82ab95c1b157d

MD5 hash:

98aca6c94ef680b24885d1462ccc36af

SHA1 hash:

d18bdf0200be5448619d19d2eb492755f0b56e05

Link:

https://www.unpac.me/results/f81aa498-acdd-457c-b0e1-7e1e8a0286f2/

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/1eba154cdc2e540704eebfaca2f51fb643c44129911eb9b668f82ab95c1b157d

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	INDICATOR_KB_CERT_06aea76bac46a9e8cfe6d29e45aaf033 Create hunting rule
Author:	ditekSHen
Description:	Detects executables signed with stolen, revoked or invalid certificates

Rule name:	INDICATOR_KB_CERT_0c15be4a15bb0903c901b1d6c265302f Create hunting rule
Author:	ditekSHen
Description:	Detects executables signed with stolen, revoked or invalid certificates