MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 8542e790264aead4545ac9debccff734d9dbe33993c5a419361befb87ea4a79a. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


BazaLoader


Vendor detections: 7


Intelligence 7 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 8542e790264aead4545ac9debccff734d9dbe33993c5a419361befb87ea4a79a
SHA3-384 hash: c8425ffb21d9e3ab97f96647bd8066cf68ef1914e63d22383078c12846b7f3fd86996602b9eb3ea4cda4d43bc9ffe725
SHA1 hash: 108c4f426968e5e1f00a61499506126ee2ef197f
MD5 hash: 2563382a0ba552afc0ad8571a6815f6d
humanhash: twelve-oven-diet-nitrogen
File name:2563382a0ba552afc0ad8571a6815f6d.dll
Download: download sample
Signature BazaLoader
Create hunting rule
File size:1'318'026 bytes
First seen:2021-09-28 06:25:30 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash 126feacb5b6732ad1a4ed77f47cf4f6d (8 x BazaLoader)
ssdeep 24576:TqSPG9Jg6TYbmGBtf9efojVpVwKYs1tRCS7SPFL3EOGTWqG5QVEzAJ24GOy2ioL3:TyWbmGBtf9efojVpVwKYs1tR/7SPFL3O
Threatray 14 similar samples on MalwareBazaar
TLSH T17655D696EE6351E0F4B7E23586A67627B9713D148334C78783005B171B62FF099BE38A
Reporter abuse_ch
Tags:BazaLoader dll exe

Intelligence

File Origin
# of uploads :
1
# of downloads :
126
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
2563382a0ba552afc0ad8571a6815f6d.dll
Verdict:
No threats detected
Analysis date:
2021-09-28 06:28:51 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/e8291425-f5a5-489a-8b0d-66c3985394ca

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
Bazar
Create hunting rule
Link:
https://www.capesandbox.com/analysis/192380/
Detection(s):
SecuriteInfo.com.Win64.BazarLoader.AS.UNOFFICIAL
Create hunting rule

Result
Verdict:
Clean
Maliciousness:

Behaviour
Creating a window
Transferring files using the Background Intelligent Transfer Service (BITS)
Launching a process
Malware family:
BazarBackdoor
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/d4feec9c-9f64-45cd-a689-163742012120
Result
Threat name:
Bazar Loader
Create hunting rule
Detection:
malicious
Classification:
spyw.evad
Score:
88 / 100
Link:
https://www.joesandbox.com/analysis/859618
Signature
Allocates memory in foreign processes
Detected Bazar Loader
Injects a PE file into a foreign processes
Modifies the context of a thread in another process (thread injection)
Sample uses process hollowing technique
Sigma detected: CobaltStrike Load by Rundll32
Sigma detected: Suspicious Svchost Process
System process connects to network (likely due to code injection or exploit)
Writes to foreign memory regions
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 492048 Sample: jl9fLPhFtU.dll Startdate: 28/09/2021 Architecture: WINDOWS Score: 88 64 Detected Bazar Loader 2->64 66 Sigma detected: CobaltStrike Load by Rundll32 2->66 68 Sigma detected: Suspicious Svchost Process 2->68 8 loaddll64.exe 1 2->8         started        10 rundll32.exe 2->10         started        12 rundll32.exe 2->12         started        process3 process4 14 cmd.exe 1 8->14         started        16 rundll32.exe 8->16         started        19 rundll32.exe 14 8->19         started        21 19 other processes 8->21 dnsIp5 24 rundll32.exe 14 14->24         started        52 System process connects to network (likely due to code injection or exploit) 16->52 54 Allocates memory in foreign processes 16->54 56 Modifies the context of a thread in another process (thread injection) 16->56 58 Sample uses process hollowing technique 19->58 60 Injects a PE file into a foreign processes 19->60 28 svchost.exe 19->28         started        42 192.168.2.1 unknown unknown 21->42 30 iexplore.exe 5 142 21->30         started        signatures6 process7 dnsIp8 44 161.35.19.83, 443, 49846, 49859 DIGITALOCEAN-ASNUS United States 24->44 70 Writes to foreign memory regions 24->70 72 Allocates memory in foreign processes 24->72 74 Modifies the context of a thread in another process (thread injection) 24->74 76 2 other signatures 24->76 32 svchost.exe 24->32         started        46 prod.appnexus.map.fastly.net 151.101.1.108, 443, 49820, 49821 FASTLYUS United States 30->46 48 tls13.taboola.map.fastly.net 151.101.1.44, 443, 49817, 49818 FASTLYUS United States 30->48 50 12 other IPs or domains 30->50 signatures9 process10 dnsIp11 36 new-fp-shed.wg1.b.yahoo.com 87.248.100.214, 443, 49893, 49899 YAHOO-IRDGB United Kingdom 32->36 38 www.google.com 142.250.185.196, 443, 49906, 49907 GOOGLEUS United States 32->38 40 5 other IPs or domains 32->40 62 System process connects to network (likely due to code injection or exploit) 32->62 signatures12
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/8542e790264aead4545ac9debccff734d9dbe33993c5a419361befb87ea4a79a/
Threat name:
Win64.Trojan.Sdum
Create hunting rule
Status:
Malicious
First seen:
2021-09-28 06:26:08 UTC
AV detection:
1 of 44 (2.27%)
Threat level:
  5/5
Verdict:
suspicious
Similar samples:
01563f8120225436d86eb915c4ccdf97a78fda65c4b3fa613a30e3faf0f35840
BazaLoader
0ade5a6d2fbbec04e69053d50ca34587f413fd28ddd8ccec490b3d0196db135e
BazaLoader
0f8c4123a1849e5b877422d80ce94199cc3be7cb77801fd0ba944fe595ffc382
BazaLoader
1d08bcc9e5ed8f7bbc161f81790198f8100e9a34952ccf4227f2625c6a15f445
BazaLoader
323fb5f9e95ef64d5798c6f6948d1dca562232a8918a0c7e7d966d573d5c1918
BazaLoader
8b971c2c4c9a020eb274c36db20bc0e1b203a7909d63f48f99bef5594110929f
BazaLoader
976328794f9114fe51c80ce0f05e4a35a94802c2fd99f3eb3c8bdeccbff5adb7
BazaLoader
c1ff5e402a811df59ac3ab7e16ac68c25b47f5ea7c6930f7799c72389ef06045
BazaLoader
dcf67fd6bfb62bea66f5e45d871d6c15b0c61d85c5fa9e9ded03e57f83dfc814
BazaLoader
f0f17791fd8bb76772cfaeb750a7bc21ca160a2c2b24be400103b1c3ee8fdc99
BazaLoader
+ 4 additional samples on MalwareBazaar
Result
Malware family:
bazarloader
Create hunting rule
Score:
  10/10
Tags:
family:bazarloader dropper loader
Link:
https://tria.ge/reports/210928-g68ahsagh6/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of WriteProcessMemory
Suspicious use of SetThreadContext
Bazar/Team9 Loader payload
Bazar Loader
Unpacked files
SH256 hash:
8542e790264aead4545ac9debccff734d9dbe33993c5a419361befb87ea4a79a
MD5 hash:
2563382a0ba552afc0ad8571a6815f6d
SHA1 hash:
108c4f426968e5e1f00a61499506126ee2ef197f
Link:
https://www.unpac.me/results/872d7da3-6615-49bf-9637-ce383ddde303/
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/8542e790264a/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/8542e790264aead4545ac9debccff734d9dbe33993c5a419361befb87ea4a79a

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

BazaLoader

Executable exe 8542e790264aead4545ac9debccff734d9dbe33993c5a419361befb87ea4a79a

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/1646245/
  
Delivery method
Distributed via web download
Cape
Cape
https://www.capesandbox.com/analysis/192380/

Comments