MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 5c04755e59158fec349c14b83cbf56e72cd2e86f199f8a84a1890e9bda02af71. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


BazaLoader


Vendor detections: 5


Intelligence 5 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 5c04755e59158fec349c14b83cbf56e72cd2e86f199f8a84a1890e9bda02af71
SHA3-384 hash: baa825b400401f5db47e4fff7c19c3e74d679b71c7e7f3e9b9c82051d9126a9f7e72494ad4bc6f9cbe4f427ad88c827f
SHA1 hash: 15b3ca513777349598fcbd44ddf31410fb9a4277
MD5 hash: 533f1e8ba6b430aa9876349bb7addcb3
humanhash: helium-early-washington-robin
File name:SecuriteInfo.com.Generic.mg.533f1e8ba6b430aa.18631
Download: download sample
Signature BazaLoader
Create hunting rule
File size:1'043'044 bytes
First seen:2021-02-09 22:52:34 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash b4fde864c45f66c378efc2bedd98550f (17 x BazaLoader)
ssdeep 6144:do3pwmXC25RIyX4db7SvNJnxPGpvSiyS:ddmy2X4d
Threatray 15 similar samples on MalwareBazaar
TLSH 50257B1B72E434FCE066D634C9904245EBB5743507768FAF03E886A92F536A1AD7EB30
Reporter SecuriteInfoCom
Tags:BazaLoader

Intelligence

File Origin
# of uploads :
1
# of downloads :
112
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
SecuriteInfo.com.Generic.mg.533f1e8ba6b430aa.18631
Verdict:
No threats detected
Analysis date:
2021-02-09 22:58:46 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/b77e6bb3-bd46-4784-964d-3ae951c3d71d

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/116328/
Detection(s):
SecuriteInfo.com.Generic.mg.533f1e8ba6b430aa.18631.UNOFFICIAL
Create hunting rule

SecuriteInfo.com.Artemis018048AA9219.28755.UNOFFICIAL
Create hunting rule

Result
Verdict:
Suspicious
Maliciousness:

Behaviour
Sending a UDP request
Running batch commands
Creating a process with a hidden window
Launching a process
Result
Verdict:
UNKNOWN
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Result
Threat name:
Unknown
Detection:
malicious
Classification:
troj.evad
Score:
80 / 100
Link:
https://www.joesandbox.com/analysis/603744
Signature
Machine Learning detection for dropped file
Machine Learning detection for sample
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)
Uses ping.exe to check the status of other devices and networks
Uses ping.exe to sleep
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 350873 Sample: SecuriteInfo.com.Generic.mg... Startdate: 10/02/2021 Architecture: WINDOWS Score: 80 63 Snort IDS alert for network traffic (e.g. based on Emerging Threat rules) 2->63 65 Multi AV Scanner detection for submitted file 2->65 67 Uses ping.exe to sleep 2->67 69 2 other signatures 2->69 11 SecuriteInfo.com.Generic.mg.533f1e8ba6b430aa.exe 2->11         started        13 usbevmjnnas.exe 2->13         started        15 usbevmjnnas.exe 2->15         started        process3 process4 17 cmd.exe 1 11->17         started        dnsIp5 59 127.0.0.1 unknown unknown 17->59 71 Uses ping.exe to sleep 17->71 21 SecuriteInfo.com.Generic.mg.533f1e8ba6b430aa.exe 3 17->21         started        24 conhost.exe 17->24         started        26 PING.EXE 1 17->26         started        signatures6 process7 file8 55 C:\Users\user\AppData\...\usbevmjnnas.exe, PE32+ 21->55 dropped 57 C:\Users\...\usbevmjnnas.exe:Zone.Identifier, ASCII 21->57 dropped 28 cmd.exe 1 21->28         started        31 cmd.exe 1 21->31         started        33 cmd.exe 1 21->33         started        process9 signatures10 77 Uses ping.exe to sleep 28->77 35 usbevmjnnas.exe 28->35         started        39 conhost.exe 28->39         started        41 PING.EXE 1 28->41         started        43 conhost.exe 31->43         started        45 reg.exe 1 1 31->45         started        47 conhost.exe 33->47         started        process11 dnsIp12 61 52.37.89.225, 443, 49722, 49742 AMAZON-02US United States 35->61 73 Multi AV Scanner detection for dropped file 35->73 75 Machine Learning detection for dropped file 35->75 49 cmd.exe 1 35->49         started        signatures13 process14 process15 51 conhost.exe 49->51         started        53 reg.exe 1 49->53         started       
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/5c04755e59158fec349c14b83cbf56e72cd2e86f199f8a84a1890e9bda02af71/
Threat name:
Win64.Trojan.Wacatac
Create hunting rule
Status:
Malicious
First seen:
2021-02-09 21:23:10 UTC
AV detection:
17 of 29 (58.62%)
Threat level:
  5/5
Verdict:
unknown
Similar samples:
375cb8f99ca2f56c79bf1e632ef30b4bfd20866ca47c028688bab9fa20c69320
BazaLoader
4236b73b4d534c01917573a4d38685849d79bbe24e24c9af8b54ab9092eba676
BazaLoader
502985c35a5b440dfc18d5dc12e524726567311ebabe35cddde961acbe718cbb
BazaLoader
52b441ab29135703146fdd5d75db3b0e441c9bc187a8df4e6201a033edd0b8de
BazaLoader
5779383242bc52dd737295a5f802288cb19bb3d44a8f85c3c0a806c99d6e215d
BazaLoader
5cb9b33ca105d1f74a81fc104a8f6054c8db69f5c20091de74f877a75deceea6
BazaLoader
63b65aa8b297247365df8d10efb7e3645ccb561b74c78690db76905a584b2c26
BazaLoader
6952aba3f7389eb46d846304058bdca5347d6609f9cca947b0df9b3776b8f3ce
BazaLoader
76cdb9f1dd635489d8cf6cb294fe5805c95a090c6cf00aafe1a8a397da3b1f03
BazaLoader
951d92a848709c99656328efbc427caca665727b51e455776f67fa3cbab37c94
BazaLoader
c08a401fb0b853564f7d0f633202444b4096071b252f78c822579b1e4da4f3d0
BazaLoader
cefdcb4e5cac9b1bb183f667b39deac6bffa0337e61e4e0a323f712f168accc6
BazaLoader
df1e5e50ded27dafde6819a5dd685c435175a14def9f1aacc1d6a7aeb5fff662
BazaLoader
e0f0d4358a6f0c5a8b64bace8756e26086eee10ae7830c864c6b500bcc31b581
BazaLoader
+ 5 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  8/10
Tags:
persistence
Link:
https://tria.ge/reports/210209-gsswj3yzb2/
Behaviour
Modifies registry key
Runs ping.exe
Suspicious behavior: EnumeratesProcesses
Suspicious use of WriteProcessMemory
Adds Run key to start application
Loads dropped DLL
Executes dropped EXE
Unpacked files
SH256 hash:
5c04755e59158fec349c14b83cbf56e72cd2e86f199f8a84a1890e9bda02af71
MD5 hash:
533f1e8ba6b430aa9876349bb7addcb3
SHA1 hash:
15b3ca513777349598fcbd44ddf31410fb9a4277
Link:
https://www.unpac.me/results/560120d1-06f2-4a6d-a6a3-d41fded3efd9/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Trojan
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/5c04755e59158fec349c14b83cbf56e72cd2e86f199f8a84a1890e9bda02af71

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

BazaLoader

Executable exe 5c04755e59158fec349c14b83cbf56e72cd2e86f199f8a84a1890e9bda02af71

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/997639/
  
Delivery method
Distributed via web download
Cape
Cape
https://www.capesandbox.com/analysis/116328/

Comments