MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 880e2c5548284e08c44028f419a98350fa58e9f758a57f4ddb7b5d6e48fc7eb9. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


BazaLoader


Vendor detections: 7


Intelligence 7 IOCs YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 880e2c5548284e08c44028f419a98350fa58e9f758a57f4ddb7b5d6e48fc7eb9
SHA3-384 hash: c355a05ab3230241970530b94dbfc17202b790bc97afd123a26338ea64d79881f978f9e60aa292df176bfde8c096c6cf
SHA1 hash: 0f7bdc996c4ceae934ec0eb32f99abb2791a5c7a
MD5 hash: d34ed24ab185444fb614a57fc4f6328a
humanhash: tango-eight-kitten-timing
File name:Attachments.dll
Download: download sample
Signature BazaLoader
Create hunting rule
File size:267'264 bytes
First seen:2021-11-16 11:21:00 UTC
Last seen:2021-11-16 12:36:40 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash 9e9b9dc9a1d7fc9680151ec542607c93 (6 x BazaLoader)
ssdeep 3072:z3y1HrmQ6GpAxYcQ9ee/YOYScqMNe7EuLT2IYGPShoFvdBpzXjKyPCJGKey1uZnv:z3Cz6+NcQoZOx75YGaho7IJGKeDJzV
Threatray 27 similar samples on MalwareBazaar
TLSH T18D44D057A7E90CBBD42B8239C8634A59E776B8150B30EBEF1354035A2F237D15C3AB64
Reporter JAMESWT_WT
Tags:BazaLoader exe

Intelligence

File Origin
# of uploads :
3
# of downloads :
113
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/206386/
Detection(s):
SecuriteInfo.com.W64.Sdum.J.genEldorado.17715.7933.UNOFFICIAL
Create hunting rule

Result
Verdict:
Clean
Maliciousness:

Behaviour
Sending a UDP request
Verdict:
Suspicious
Threat level:
  5/10
Confidence:
100%
Tags:
greyware monero
Link:
https://www.filescan.io/uploads/6193942043e8f62b6695375b/reports/d8496c76-0a03-4f03-ab53-65a31d19811f/overview
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
Generic Malware
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/338c20be-349d-406f-bcef-523977309f86
Result
Threat name:
Unknown
Detection:
malicious
Classification:
troj.evad
Score:
60 / 100
Link:
https://www.joesandbox.com/analysis/890303
Signature
Found potential dummy code loops (likely to delay analysis)
Multi AV Scanner detection for submitted file
Uses ping.exe to check the status of other devices and networks
Uses ping.exe to sleep
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 522776 Sample: Attachments.dll Startdate: 16/11/2021 Architecture: WINDOWS Score: 60 21 192.0.2.23 unknown Reserved 2->21 23 Multi AV Scanner detection for submitted file 2->23 8 loaddll64.exe 1 2->8         started        signatures3 process4 process5 10 cmd.exe 1 8->10         started        13 rundll32.exe 8->13         started        15 rundll32.exe 8->15         started        17 3 other processes 8->17 signatures6 25 Uses ping.exe to sleep 10->25 27 Uses ping.exe to check the status of other devices and networks 10->27 19 rundll32.exe 10->19         started        29 Found potential dummy code loops (likely to delay analysis) 13->29 process7
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/880e2c5548284e08c44028f419a98350fa58e9f758a57f4ddb7b5d6e48fc7eb9/
Threat name:
Win64.Trojan.Bazaloader
Create hunting rule
Status:
Malicious
First seen:
2021-11-16 11:21:19 UTC
AV detection:
17 of 28 (60.71%)
Threat level:
  5/5
Verdict:
unknown
Similar samples:
100ab1a8d68493c43a477aa54948803f96a31b4c7854840a505de009d6c360a8
BazaLoader
15db7f06895bdf1b299f977b5a513eea85490541fa990b02b5612b31b5a3bf68
BazaLoader
33082f1f702c0919efd47a7c935aa3972c90f7f7419c9aa6c87492f57658d403
BazaLoader
6035d44fa6845d348946b868b93fbb60a43873f731f96ef6e8a54a9b4a73103a
BazaLoader
6d8fcc850b8c796be3f6244f1f681332d155486bdd326ad6be78ea7172718db4
BazaLoader
7a33388ff7dd7e507fef9fa7ed4e417af518c8a81a9d7bcd910723d16c940e76
BazaLoader
95347bea5432c09cc216f5db771b956eb78a43139789036af9446139967b1c7f
BazaLoader
b24e47b63ec35e9a420b9fbb64106b2f9e6e8a18676e8c79ff2ca67af06f1291
BazaLoader
b2a4b60dd0c7e9dfa6d88e9badad810ff74c5f42054b7af22e95fb5553d67331
BazaLoader
e192593ff1df7a3d24cc9463fdcde0b39b49a26816da608d50960da3131e2e36
BazaLoader
+ 17 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  3/10
Tags:
n/a
Link:
https://tria.ge/reports/211116-nf2tdaaear/
Behaviour
Delays execution with timeout.exe
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: GetForegroundWindowSpam
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Program crash
Unpacked files
SH256 hash:
880e2c5548284e08c44028f419a98350fa58e9f758a57f4ddb7b5d6e48fc7eb9
MD5 hash:
d34ed24ab185444fb614a57fc4f6328a
SHA1 hash:
0f7bdc996c4ceae934ec0eb32f99abb2791a5c7a
Link:
https://www.unpac.me/results/c8a35f31-2348-43cd-ade9-d4cf909fe05a/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/880e2c5548284e08c44028f419a98350fa58e9f758a57f4ddb7b5d6e48fc7eb9

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:BitcoinAddress
Create hunting rule
Author:Didier Stevens (@DidierStevens)
Description:Contains a valid Bitcoin address

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/206386/

Comments