MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 69c6638c277af7f94f34c6f1ea1cee9d7cf5ee7a1e8ef0d2df527f8d6a529f5f. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


BazaLoader


Vendor detections: 7


Intelligence 7 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 69c6638c277af7f94f34c6f1ea1cee9d7cf5ee7a1e8ef0d2df527f8d6a529f5f
SHA3-384 hash: ed22ab49c6965d271009342887a5c53020ca30f766443089d677bf4cadd7941b46809f7f940c44b498ba3e845a060712
SHA1 hash: 82a1391dcc48e75fad5814fb1f24d81be9413f1f
MD5 hash: 095f7940b05adb24a49e1d18a3b24c69
humanhash: beer-sixteen-pip-may
File name:095f7940b05adb24a49e1d18a3b24c69.dll
Download: download sample
Signature BazaLoader
Create hunting rule
File size:230'400 bytes
First seen:2021-11-16 20:37:50 UTC
Last seen:2021-11-16 23:02:43 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash 9e9b9dc9a1d7fc9680151ec542607c93 (6 x BazaLoader)
ssdeep 6144:Sf8tUWFEPR+SJ5CIhsFSLls0iN1TlB0+UMc:gR+y5CnvTlBVUD
Threatray 29 similar samples on MalwareBazaar
TLSH T1A934CE97B6E9457BE4779239C4A30661E776B8010B108AEF0360537AAF137E19D3EF21
Reporter abuse_ch
Tags:BazaLoader dll exe

Intelligence

File Origin
# of uploads :
2
# of downloads :
127
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/206629/
Detection(s):
SecuriteInfo.com.W64.Sdum.J.genEldorado.22980.31695.UNOFFICIAL
Create hunting rule

Result
Verdict:
Clean
Maliciousness:
Verdict:
Suspicious
Threat level:
  5/10
Confidence:
100%
Tags:
greyware packed
Link:
https://www.filescan.io/uploads/619416b12695a62af9f18c8b/reports/e3e8f624-c773-41bf-85bb-36820d0bdfd7/overview
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
Generic Malware
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/4aa99c64-c281-4318-acfb-907492187396
Result
Threat name:
Unknown
Detection:
malicious
Classification:
troj.evad
Score:
60 / 100
Link:
https://www.joesandbox.com/analysis/890724
Signature
Found potential dummy code loops (likely to delay analysis)
Multi AV Scanner detection for submitted file
Uses ping.exe to check the status of other devices and networks
Uses ping.exe to sleep
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 523200 Sample: D5a3nquTJq.dll Startdate: 16/11/2021 Architecture: WINDOWS Score: 60 42 Multi AV Scanner detection for submitted file 2->42 9 loaddll64.exe 1 2->9         started        process3 process4 11 cmd.exe 1 9->11         started        14 rundll32.exe 9->14         started        16 rundll32.exe 9->16         started        18 6 other processes 9->18 signatures5 46 Uses ping.exe to sleep 11->46 48 Uses ping.exe to check the status of other devices and networks 11->48 20 rundll32.exe 11->20         started        50 Found potential dummy code loops (likely to delay analysis) 14->50 22 cmd.exe 1 14->22         started        process6 process7 24 cmd.exe 1 20->24         started        27 rundll32.exe 22->27         started        29 conhost.exe 22->29         started        31 timeout.exe 1 22->31         started        signatures8 44 Uses ping.exe to sleep 24->44 33 PING.EXE 1 24->33         started        36 rundll32.exe 24->36         started        38 conhost.exe 24->38         started        process9 dnsIp10 40 192.0.2.160 unknown Reserved 33->40
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/69c6638c277af7f94f34c6f1ea1cee9d7cf5ee7a1e8ef0d2df527f8d6a529f5f/
Threat name:
Win64.Packed.Generic
Create hunting rule
Status:
Suspicious
First seen:
2021-11-16 11:29:01 UTC
AV detection:
16 of 27 (59.26%)
Threat level:
  1/5
Verdict:
unknown
Similar samples:
100ab1a8d68493c43a477aa54948803f96a31b4c7854840a505de009d6c360a8
BazaLoader
2a2b204b3d8df0388dd42a8fa5b7e9652f262c15b92de6ff13fec8778a6aac3f
BazaLoader
33082f1f702c0919efd47a7c935aa3972c90f7f7419c9aa6c87492f57658d403
BazaLoader
6035d44fa6845d348946b868b93fbb60a43873f731f96ef6e8a54a9b4a73103a
BazaLoader
6d8fcc850b8c796be3f6244f1f681332d155486bdd326ad6be78ea7172718db4
BazaLoader
880e2c5548284e08c44028f419a98350fa58e9f758a57f4ddb7b5d6e48fc7eb9
BazaLoader
95347bea5432c09cc216f5db771b956eb78a43139789036af9446139967b1c7f
BazaLoader
b24e47b63ec35e9a420b9fbb64106b2f9e6e8a18676e8c79ff2ca67af06f1291
BazaLoader
b2a4b60dd0c7e9dfa6d88e9badad810ff74c5f42054b7af22e95fb5553d67331
BazaLoader
e192593ff1df7a3d24cc9463fdcde0b39b49a26816da608d50960da3131e2e36
BazaLoader
+ 19 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  3/10
Tags:
n/a
Link:
https://tria.ge/reports/211116-zeqkhafde3/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: GetForegroundWindowSpam
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Program crash
Unpacked files
SH256 hash:
69c6638c277af7f94f34c6f1ea1cee9d7cf5ee7a1e8ef0d2df527f8d6a529f5f
MD5 hash:
095f7940b05adb24a49e1d18a3b24c69
SHA1 hash:
82a1391dcc48e75fad5814fb1f24d81be9413f1f
Link:
https://www.unpac.me/results/b991a3c4-3009-4eeb-812f-30fa5b814837/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/69c6638c277af7f94f34c6f1ea1cee9d7cf5ee7a1e8ef0d2df527f8d6a529f5f

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/206629/

Comments