MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 3b86c9516bd5d57758ab976e32af2d7873d7ad0b0e063a49ee13c168f2c1e980. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


BazaLoader


Vendor detections: 7


Intelligence 7 IOCs YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 3b86c9516bd5d57758ab976e32af2d7873d7ad0b0e063a49ee13c168f2c1e980
SHA3-384 hash: b761a6f20c3a5d991a08a3e5021ac23a4963e66cb1bf458b57c06af56dbaca5522e0d7479c96b59cadb03f0c4308c61a
SHA1 hash: 9361621490915ebb919b79c6101874f03e4e51bc
MD5 hash: 9fbff5e231c2cad8612ad112e1bb78ea
humanhash: echo-seven-lima-autumn
File name:Document-19-51-48.js
Download: download sample
Signature BazaLoader
Create hunting rule
File size:279'705 bytes
First seen:2024-09-27 19:56:10 UTC
Last seen:Never
File type:Java Script (JS) js
MIME type:text/plain
ssdeep 3072:H+FQrJa+5ApN2dxv9nA/ClEblhFWMVR/LIzZoUifPcC2YD3o7RGsEkG9XZPlg:eGNBig9xebBWMVhszyU7vy9E
Threatray 221 similar samples on MalwareBazaar
TLSH T15C541A2777442334DDA30291624E25EAF76DA53C635583706C9EE32C224686CEB3BDDB
Magika txt
Reporter pr0xylife
Tags:BazaLoader BruteRatel js Latrodectus

Intelligence

File Origin
# of uploads :
1
# of downloads :
945
Origin country :
NL NL
Vendor Threat Intelligence
Verdict:
Malicious
Score:
92.5%
Link:
https://cyber-fortress.com/docs/result/index.php?id=66f70e1079032805ce8e9b5d
Tags:
Execution Exploit Generic Network Stealth Exploit Tori Sage
Verdict:
Likely Malicious
Threat level:
  7.5/10
Confidence:
100%
Tags:
expand lolbin remote shell32
Link:
https://www.filescan.io/uploads/66f70e10b240a2b637c86745/reports/ccc6d167-bd3c-40d7-8ad9-6da6e4f5d311/overview
Verdict:
Unknown
Link:
https://www.hybrid-analysis.com/sample/3b86c9516bd5d57758ab976e32af2d7873d7ad0b0e063a49ee13c168f2c1e980
Result
Verdict:
UNKNOWN
Result
Threat name:
Bazar Loader, BruteRatel, Latrodectus
Create hunting rule
Detection:
malicious
Classification:
spre.troj.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1520781
Signature
Allocates memory in foreign processes
C2 URLs / IPs found in malware configuration
Contains functionality to inject threads in other processes
Creates a thread in another existing process (thread injection)
Drops executables to the windows directory (C:\Windows) and starts them
Found malware configuration
Injects a PE file into a foreign processes
Injects code into the Windows Explorer (explorer.exe)
Sample has a suspicious name (potential lure to open the executable)
Sample uses string decryption to hide its real strings
Sets debug register (to hijack the execution of another thread)
Sigma detected: RunDLL32 Spawning Explorer
Sigma detected: WScript or CScript Dropper
Suricata IDS alerts for network traffic
System process connects to network (likely due to code injection or exploit)
Windows Scripting host queries suspicious COM object (likely to drop second stage)
Writes to foreign memory regions
Wscript install MSI file from remote location
Yara detected Bazar Loader
Yara detected BruteRatel
Yara detected Generic JS Downloader
Yara detected Latrodectus
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1520781 Sample: Document-19-51-48.js Startdate: 27/09/2024 Architecture: WINDOWS Score: 100 39 tiguanin.com 2->39 41 isomicrotich.com 2->41 43 2 other IPs or domains 2->43 55 Suricata IDS alerts for network traffic 2->55 57 Found malware configuration 2->57 59 Yara detected Generic JS Downloader 2->59 61 9 other signatures 2->61 10 msiexec.exe 14 38 2->10         started        15 wscript.exe 1 2->15         started        signatures3 process4 dnsIp5 51 194.54.156.91, 49730, 80 CRIMEAINFOCOM-ASUA Ukraine 10->51 31 C:\Windows\Installer\MSI1EC8.tmp, PE32 10->31 dropped 33 C:\Users\user\AppData\...\vierm_soft_x64.dll, PE32+ 10->33 dropped 35 C:\Windows\Installer\MSI1DFB.tmp, PE32 10->35 dropped 37 3 other files (none is malicious) 10->37 dropped 71 Drops executables to the windows directory (C:\Windows) and starts them 10->71 17 MSI1EC8.tmp 1 10->17         started        19 msiexec.exe 10->19         started        73 Windows Scripting host queries suspicious COM object (likely to drop second stage) 15->73 file6 signatures7 process8 process9 21 rundll32.exe 17->21         started        process10 23 rundll32.exe 8 12 21->23         started        dnsIp11 45 bazarunet.com 185.106.92.54, 49402, 49403, 49404 SUPERSERVERSDATACENTERRU Russian Federation 23->45 47 greshunka.com 82.115.223.39, 49407, 49409, 49411 MIDNET-ASTK-TelecomRU Russian Federation 23->47 49 tiguanin.com 82.115.223.40, 49401, 49408, 49412 MIDNET-ASTK-TelecomRU Russian Federation 23->49 63 System process connects to network (likely due to code injection or exploit) 23->63 65 Contains functionality to inject threads in other processes 23->65 67 Injects code into the Windows Explorer (explorer.exe) 23->67 69 5 other signatures 23->69 27 explorer.exe 41 1 23->27 injected signatures12 process13 dnsIp14 53 isomicrotich.com 188.114.96.3, 443, 49418, 49419 CLOUDFLARENETUS European Union 27->53 75 System process connects to network (likely due to code injection or exploit) 27->75 signatures15
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/3b86c9516bd5d57758ab976e32af2d7873d7ad0b0e063a49ee13c168f2c1e980/
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=hodmsull2xkxowfls5xdflznpbz5plilbydduspocpawr4wb5gaa._file
Verdict:
malicious
Label(s):
bruteratelc4
Create hunting rule
Similar samples:
1b9e17bfbd292075956cc2006983f91e17aed94ebbb0fb370bf83d23b14289fa
BazaLoader
2b0af73350b8a2b37617ca7632de9a0657a20976c2402717e7dc4bef7dcbabdb
BazaLoader
2dcaecbd2d152af35590f83accbaea894e2b6e55284cd187ad6308fd300d42ed
BazaLoader
617e31e9f71b365fe69719d3fc980d763e827a4f93d0e776d1587d0bfdb47674
BazaLoader
c3f8ebc9cfb7ebe1ebbe3a4210753b271fecf73392fef98519b823a3e7c056c7
BazaLoader
f60c7e2cd7078584e1fb2eacd6270c314f1e23f76a4cd78c5d13eec215f0e41c
BazaLoader
+ 211 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  8/10
Tags:
discovery execution
Link:
https://tria.ge/reports/240927-yn88jayhkc/
Behaviour
Modifies data under HKEY_USERS
Modifies system certificate store
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Command and Scripting Interpreter: JavaScript
System Location Discovery: System Language Discovery
Drops file in Windows directory
Enumerates connected drives
Executes dropped EXE
Loads dropped DLL
Blocklisted process makes network request
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/3b86c9516bd5d57758ab976e32af2d7873d7ad0b0e063a49ee13c168f2c1e980

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:test_Malaysia
Create hunting rule
Author:rectifyq
Description:Detects file containing malaysia string

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Comments