MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 74d117615930c1a51e28e7db460a6f6135eb5070f0975598267e7f07d5a170f7. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

BazarCall

Vendor detections: 7

Intelligence 7 IOCs YARA 2 File information Comments

SHA256 hash:	74d117615930c1a51e28e7db460a6f6135eb5070f0975598267e7f07d5a170f7
SHA3-384 hash:	465afb94f61c3fbeb8075b007adaa62004e958ce13766f3a06e882fe48de3543806a611cb27a5397107438a93ada9561
SHA1 hash:	4e942223b754d3cfd0b5e9991dd5fa95096059fa
MD5 hash:	78388676e1ebde4576357c3727a51787
humanhash:	thirteen-fix-glucose-stairway
File name:	78388676e1ebde4576357c3727a51787.exe
Download:	download sample
Signature	BazarCall Create hunting rule
File size:	668'768 bytes
First seen:	2021-03-24 19:50:17 UTC
Last seen:	2021-03-24 21:31:46 UTC
File type:	exe
MIME type:	application/x-dosexec
imphash	e6cc073c49124b726752da491045a2c7 (4 x BazarCall)
ssdeep	3072:qYxLJ16SuUyoUpHDRepPjc7UqVu24ak0J05W+lBny4bwrti111Rm9OACxC:qYFTyo+Hshcf1kux+HnydP9OAA
Threatray	9 similar samples on MalwareBazaar
TLSH	C6E48C15A2A40AF6D8A397B888A58607FDF374411B24CB9F07644671DF563C27F2CFA1
Reporter	abuse_ch
Tags:	BazarCall exe

Intelligence

File Origin

# of uploads :

# of downloads :

170

Origin country :

n/a

Vendor Threat Intelligence

Malware family:

n/a

ID:

File name:

retrsd25.exe

Verdict:

No threats detected

Analysis date:

2021-03-24 19:15:55 UTC

Tags:

n/a

Link:

https://app.any.run/tasks/f82f2b47-7cb4-4ab1-aa68-9326b040cf43

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

Detection(s):

SecuriteInfo.com.Variant.Razy.854842.13421.30419.UNOFFICIAL

Result

Verdict:

Malware

Maliciousness:

Behaviour

Sending a custom TCP request

Transferring files using the Background Intelligent Transfer Service (BITS)

Sending a UDP request

Launching a process

Unauthorized injection to a recently created process

Unauthorized injection to a recently created process by context flags manipulation

Result

Verdict:

MALICIOUS

Details

Windows PE Executable

Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.

Verdict:

Malicious

Link:

https://analyze.intezer.com/analyses/11f12e49-e098-40e6-8488-3d913a8b3fb2

Result

Threat name:

Unknown

Detection:

malicious

Classification:

evad

Score:

80 / 100

Link:

https://www.joesandbox.com/analysis/652950

Signature

Allocates memory in foreign processes

Injects a PE file into a foreign processes

Modifies the context of a thread in another process (thread injection)

Multi AV Scanner detection for submitted file

Sample uses process hollowing technique

Sets debug register (to hijack the execution of another thread)

Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)

Writes to foreign memory regions

Behaviour

Behavior Graph:

Download SVG

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/74d117615930c1a51e28e7db460a6f6135eb5070f0975598267e7f07d5a170f7/

Threat name:

Win64.Trojan.CobaltStrike

Status:

Malicious

First seen:

2021-03-24 19:51:06 UTC

AV detection:

15 of 29 (51.72%)

Threat level:

5/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=otiroykzgda2khri47numctpme26wudq6clvlgbgpz7qpvnbod3q._file

Verdict:

suspicious

BazarCall

2fe32b0f648bfe69c9873c7a57a62358057eab750a081f9285c11e94327c42d6

BazarCall

4294a73a1d708f475bc957ed10e04b6dbfb238a50a963c0a5393f35bcd9d9d7e

BazarCall

4435942b9f09846a337474f396fd0a885f41742f05899dcc1a12b6b44a31126b

BazarCall

911d3b7d0ad2b9408ca63c381a73f38b15019954d4ff6ffe3fcac8f716c2a200

BazarCall

98cbdd45b45679061e3a3741cc2a32ef8abbc599de118a4604cff54b528cdaf3

BazarCall

cac07a4582d65b74322168e6aed9d7fd05e59e335fb7d1cdb7b5f7149a07d3eb

BazarCall

df25322be14f617652607a150c806b4ecb3a3317564755518b8100063b58a50e

BazarCall

eb1eb139750b9e73d8d27448b93f9a3c0931f50572cd95282e9f205a0caa7e79

BazarCall

Result

Malware family:

n/a

Score:

8/10

Tags:

n/a

Link:

https://tria.ge/reports/210324-6wb9h5csvj/

Behaviour

Suspicious behavior: EnumeratesProcesses

Suspicious use of WriteProcessMemory

Suspicious use of SetThreadContext

Blocklisted process makes network request

Unpacked files

SH256 hash:

74d117615930c1a51e28e7db460a6f6135eb5070f0975598267e7f07d5a170f7

MD5 hash:

78388676e1ebde4576357c3727a51787

SHA1 hash:

4e942223b754d3cfd0b5e9991dd5fa95096059fa

Link:

https://www.unpac.me/results/e78088d8-d9b1-4e49-b3c7-4f3dacbf22b8/

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/74d117615930c1a51e28e7db460a6f6135eb5070f0975598267e7f07d5a170f7

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	INDICATOR_KB_CERT_06aea76bac46a9e8cfe6d29e45aaf033 Create hunting rule
Author:	ditekSHen
Description:	Detects executables signed with stolen, revoked or invalid certificates

Rule name:	INDICATOR_KB_CERT_0c15be4a15bb0903c901b1d6c265302f Create hunting rule
Author:	ditekSHen
Description:	Detects executables signed with stolen, revoked or invalid certificates