MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 6035d44fa6845d348946b868b93fbb60a43873f731f96ef6e8a54a9b4a73103a. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 8


Intelligence 8 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 6035d44fa6845d348946b868b93fbb60a43873f731f96ef6e8a54a9b4a73103a
SHA3-384 hash: b69c195d0d4c0c5c33c3a14e1b11a7111407962ab558d6d63764743794f7608a8a0491f337b2c33b398f845930a02e93
SHA1 hash: 7ad4abe8dd678f31a9a2c78c6748e4853bad16d8
MD5 hash: 2193e90269c93bf4456b7aecda0c6bdb
humanhash: maryland-fanta-fix-mobile
File name:6035d44fa6845d348946b868b93fbb60a43873f731f96ef6e8a54a9b4a73103a
Download: download sample
File size:1'649'152 bytes
First seen:2021-11-01 21:35:11 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash ce543b95297c6bb89c2576e9105d106b (1 x BazaLoader)
ssdeep 24576:SFXFyrP3S9xKLponxHBYAEQ4Ss0LOQn65bI4vq9P73Nd:SdFyr3SbKLponxhKbSsam
Threatray 4 similar samples on MalwareBazaar
TLSH T146750916B3646591C0FBC17880836F52BA3078590B3667E74BC04665AF21BF8AE3DBF5
Reporter Anonymous
Tags:exe

Intelligence

File Origin
# of uploads :
1
# of downloads :
94
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
6035d44fa6845d348946b868b93fbb60a43873f731f96ef6e8a54a9b4a73103a
Verdict:
No threats detected
Analysis date:
2021-11-01 21:41:47 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/72dcf65a-eb01-4b1a-8cee-6df8e1558929

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/201206/
Detection(s):
SecuriteInfo.com.Win64.BazarLoader.BH.12336.19527.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
anti-debug greyware monero
Link:
https://www.filescan.io/uploads/61805dc4bf51178dbe466fb0/reports/79e6f880-7004-4b13-bef4-c0123c641f24/overview
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
BazarLoader
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/3e53a618-950a-446b-9fa9-530a936b49c3
Result
Threat name:
Unknown
Detection:
malicious
Classification:
troj.evad
Score:
64 / 100
Link:
https://www.joesandbox.com/analysis/880778
Signature
Creates an autostart registry key pointing to binary in C:\Windows
Sigma detected: UNC2452 Process Creation Patterns
Uses cmd line tools excessively to alter registry or file data
Uses ping.exe to check the status of other devices and networks
Uses ping.exe to sleep
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 513208 Sample: IhYFHdpJ83 Startdate: 01/11/2021 Architecture: WINDOWS Score: 64 79 Sigma detected: UNC2452 Process Creation Patterns 2->79 10 loaddll64.exe 1 2->10         started        12 rundll32.exe 2->12         started        14 rundll32.exe 2->14         started        process3 process4 16 rundll32.exe 10->16         started        18 rundll32.exe 10->18         started        20 cmd.exe 1 10->20         started        23 rundll32.exe 10->23         started        25 cmd.exe 12->25         started        signatures5 27 cmd.exe 1 16->27         started        30 cmd.exe 1 18->30         started        81 Uses ping.exe to sleep 20->81 83 Uses cmd line tools excessively to alter registry or file data 20->83 85 Uses ping.exe to check the status of other devices and networks 20->85 32 rundll32.exe 20->32         started        process6 signatures7 89 Uses ping.exe to sleep 27->89 34 rundll32.exe 27->34         started        36 PING.EXE 1 27->36         started        39 conhost.exe 27->39         started        41 rundll32.exe 30->41         started        43 PING.EXE 1 30->43         started        45 conhost.exe 30->45         started        process8 dnsIp9 47 cmd.exe 1 34->47         started        50 cmd.exe 1 34->50         started        75 127.0.0.1 unknown unknown 36->75 52 cmd.exe 1 41->52         started        54 cmd.exe 1 41->54         started        77 192.0.2.213 unknown Reserved 43->77 process10 signatures11 91 Uses cmd line tools excessively to alter registry or file data 47->91 56 reg.exe 1 1 47->56         started        59 conhost.exe 47->59         started        61 rundll32.exe 50->61         started        63 conhost.exe 50->63         started        65 choice.exe 1 50->65         started        67 conhost.exe 52->67         started        69 reg.exe 1 52->69         started        71 conhost.exe 54->71         started        73 2 other processes 54->73 process12 signatures13 87 Creates an autostart registry key pointing to binary in C:\Windows 56->87
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/6035d44fa6845d348946b868b93fbb60a43873f731f96ef6e8a54a9b4a73103a/
Threat name:
Win64.Trojan.BazarLoader
Create hunting rule
Status:
Malicious
First seen:
2021-11-01 21:36:06 UTC
AV detection:
10 of 27 (37.04%)
Threat level:
  5/5
Verdict:
unknown
Similar samples:
15db7f06895bdf1b299f977b5a513eea85490541fa990b02b5612b31b5a3bf68
6d8fcc850b8c796be3f6244f1f681332d155486bdd326ad6be78ea7172718db4
7a33388ff7dd7e507fef9fa7ed4e417af518c8a81a9d7bcd910723d16c940e76
Result
Malware family:
n/a
Score:
  1/10
Tags:
n/a
Link:
https://tria.ge/reports/211101-1ff8wsagg5/
Behaviour
Runs ping.exe
Suspicious use of WriteProcessMemory
Unpacked files
SH256 hash:
6035d44fa6845d348946b868b93fbb60a43873f731f96ef6e8a54a9b4a73103a
MD5 hash:
2193e90269c93bf4456b7aecda0c6bdb
SHA1 hash:
7ad4abe8dd678f31a9a2c78c6748e4853bad16d8
Link:
https://www.unpac.me/results/cd27a2f7-b190-4dbc-89a7-6b990a40c923/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/6035d44fa6845d348946b868b93fbb60a43873f731f96ef6e8a54a9b4a73103a

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/201206/

Comments