MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 2b0af73350b8a2b37617ca7632de9a0657a20976c2402717e7dc4bef7dcbabdb. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

BruteRatel

Vendor detections: 11

Intelligence 11 IOCs YARA 8 File information Comments

SHA256 hash:	2b0af73350b8a2b37617ca7632de9a0657a20976c2402717e7dc4bef7dcbabdb
SHA3-384 hash:	c9a17596599a1d78bf8c0d086f7de183ec8ceb348b95f0fe540ebc3802bc39027a9540ddf76f27fe5472da9ced478e93
SHA1 hash:	46acec8a8cda40acbd6ac098b2283db81c1b12ee
MD5 hash:	191fc2a008bac8a013e6fc50639c9758
humanhash:	burger-pasta-east-happy
File name:	dsa.msi
Download:	download sample
Signature	BruteRatel Create hunting rule
File size:	1'685'504 bytes
First seen:	2024-09-27 19:36:22 UTC
Last seen:	2024-09-27 19:56:18 UTC
File type:	msi
MIME type:	application/x-msi
ssdeep	49152:Rfj3YhW8zBQSc0ZnSKSZKumZr7AggsMrPetp:VYY0ZnQK/Ad
Threatray	198 similar samples on MalwareBazaar
TLSH	T16A75D0223386C537C96E01303A19D6AB557DFDB74B3140DBA3C8292EAE745C16639FA3
TrID	80.0% (.MSI) Microsoft Windows Installer (454500/1/170) 10.7% (.MST) Windows SDK Setup Transform script (61000/1/5) 7.8% (.MSP) Windows Installer Patch (44509/10/5) 1.4% (.) Generic OLE2 / Multistream Compound (8000/1)
Magika	msi
Reporter	k3dg3___
Tags:	BazaLoader Brute Ratel BruteRatel Latrodectus msi

Intelligence

File Origin

# of uploads :

# of downloads :

558

Origin country :

Vendor Threat Intelligence

Detection(s):

Win.Trojan.Latrodectus-10031447-0

Verdict:

Malicious

Score:

94.9%

Link:

https://cyber-fortress.com/docs/result/index.php?id=66f7096079032805ce8e9aa6

Tags:

Generic Stealth Shellcode Exploit Tori

Verdict:

Malicious

Threat level:

10/10

Confidence:

100%

Tags:

fingerprint lolbin packed peloader remote shell32 wix

Link:

https://www.filescan.io/uploads/66f70960f741081b7c993384/reports/f091db53-d175-415c-9166-19ab78f17778/overview

Verdict:

Unknown

Link:

https://www.hybrid-analysis.com/sample/2b0af73350b8a2b37617ca7632de9a0657a20976c2402717e7dc4bef7dcbabdb

Result

Verdict:

SUSPICIOUS

Link:

https://labs.inquest.net/dfi/sha256/2b0af73350b8a2b37617ca7632de9a0657a20976c2402717e7dc4bef7dcbabdb

Details

Windows PE Executable

Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.

Result

Threat name:

Bazar Loader, BruteRatel, Latrodectus

Detection:

malicious

Classification:

troj.evad

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/1520765

Signature

AI detected suspicious sample

Allocates memory in foreign processes

C2 URLs / IPs found in malware configuration

Contains functionality to inject threads in other processes

Creates a thread in another existing process (thread injection)

Drops executables to the windows directory (C:\Windows) and starts them

Found malware configuration

Injects a PE file into a foreign processes

Injects code into the Windows Explorer (explorer.exe)

Malicious sample detected (through community Yara rule)

Modifies the context of a thread in another process (thread injection)

Sample uses string decryption to hide its real strings

Sets debug register (to hijack the execution of another thread)

Sigma detected: RunDLL32 Spawning Explorer

Suricata IDS alerts for network traffic

System process connects to network (likely due to code injection or exploit)

Writes to foreign memory regions

Yara detected Bazar Loader

Yara detected BruteRatel

Yara detected Latrodectus

Behaviour

Behavior Graph:

Download SVG

Score:

91%

Verdict:

Malware

File Type:

Result

Malware family:

n/a

Score:

8/10

Tags:

discovery persistence privilege_escalation

Link:

https://tria.ge/reports/240927-ybsp1swaqq/

Behaviour

Checks SCSI registry key(s)

Modifies data under HKEY_USERS

Modifies system certificate store

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Suspicious use of FindShellTrayWindow

Suspicious use of WriteProcessMemory

Uses Volume Shadow Copy service COM API

Event Triggered Execution: Installer Packages

System Location Discovery: System Language Discovery

Drops file in Windows directory

Executes dropped EXE

Loads dropped DLL

Enumerates connected drives

Blocklisted process makes network request

Verdict:

Malicious

Tags:

brute_ratel

YARA:

n/a

Link:

https://app.threat.zone/submission/9c459142-0677-4c14-8fee-097d2a3801ca

Malware family:

Latrodectus

Verdict:

Malicious

Link:

https://www.vmray.com/analyses/_mb/2b0af73350b8/report/overview.html

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/2b0af73350b8a2b37617ca7632de9a0657a20976c2402717e7dc4bef7dcbabdb

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	DebuggerCheck__API Create hunting rule
Reference:	https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara

Rule name:	DebuggerCheck__QueryInfo Create hunting rule
Reference:	https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara

Rule name:	Detect_LATAM_MSI_Banker Create hunting rule

Rule name:	Detect_Malicious_VBScript_Base64 Create hunting rule
Author:	daniyyell
Description:	Detects malicious VBScript patterns, including Base64 decoding, file operations, and PowerShell.