MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 8d84a168fde968b3beb835a96fc340d2b4c1307e97ab677002197ed664f9838e. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 5


Intelligence 5 IOCs YARA 2 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 8d84a168fde968b3beb835a96fc340d2b4c1307e97ab677002197ed664f9838e
SHA3-384 hash: 383ca97371578651132f3a4a61a349ac00474c6f9264800c5f51e666aabfed154a831a4153c557acf5b371e473f979a4
SHA1 hash: a63c8aaff2aee9c3c858bc048c8d0f8a39601854
MD5 hash: 8a82a88b7c5b060824668a7bb79c30fb
humanhash: avocado-one-bacon-cat
File name:Document-26-10.exe
Download: download sample
File size:698'528 bytes
First seen:2020-10-26 19:27:32 UTC
Last seen:2020-10-26 21:52:15 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash 06571f99ce338e1db8d22ad520e06b2b
ssdeep 12288:7TOvACZGi5xTsw2tXYzgnh5uxfu89RHe3mIw7RslZyoF6:XOvAn8x6XYuh5sfHeWIw7Cj6
Threatray 154 similar samples on MalwareBazaar
TLSH 15E407C3F154349CF8DF827BB9DA4E25B1E27C560A432A0251713FA5BF321915BC8A6E
Reporter James_inthe_box
Tags:exe

Code Signing Certificate

Organisation:Best Fud
Issuer:DigiCert EV Code Signing CA
Algorithm:sha256WithRSAEncryption
Valid from:Aug 21 00:00:00 2020 GMT
Valid to:Jun 2 12:00:00 2021 GMT
Serial number: 085B70224253486624FC36FA658A1E32
Intelligence: 9 malware samples on MalwareBazaar are signed with this code signing certificate
MalwareBazaar Blocklist:This certificate is on the MalwareBazaar code signing certificate blocklist (CSCB)
Thumbprint Algorithm:SHA256
Thumbprint: 693CC59045DE342FBE55E06CBACD006BFBED33BEAE4000E3013CE910B967D6DB
Source:This information was brought to you by ReversingLabs A1000 Malware Analysis Platform

Intelligence

File Origin
# of uploads :
2
# of downloads :
79
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/79488/
Detection(s):
SecuriteInfo.com.BackDoor.Bazar.28.21253.978.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:
Result
Threat name:
Unknown
Detection:
malicious
Classification:
n/a
Score:
52 / 100
Link:
https://www.joesandbox.com/analysis/512769
Signature
Icon mismatch, binary includes an icon from a different legit application in order to fool users
Initial sample is a PE file and has a suspicious name
Behaviour
Behavior Graph:
Download SVG
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/8d84a168fde968b3beb835a96fc340d2b4c1307e97ab677002197ed664f9838e/
Threat name:
Win64.Trojan.Bazaloader
Create hunting rule
Status:
Malicious
First seen:
2020-10-26 19:27:09 UTC
File Type:
PE+ (Exe)
Extracted files:
9
AV detection:
26 of 29 (89.66%)
Threat level:
  5/5
Verdict:
malicious
Similar samples:
1642ec3f8d77278e1fca7e99fb3da2ada567b0186af8c1e5dcce9b2151626434
177b312a0c7c2d03be3b2916505fb3e9fdefe785330c74ac29e89cb22656367e
40e57eae3bb200542384e2da14a92ca88d1b806f9f9e8e577468da2594ad1c84
563463b7b68cb19bba718bd6d1e8e3573b7c08fbbce9d86219ea242790ee41b9
5e9ba87c848255e2291680e16843305d2b797b375a3729d9f920c1b1b9781005
725d48df047fa6420ac78350a0023bdc160ae42463544f787b188ca36697965a
9aa1dd1ba086a41187edf0ad1a133b7dc9b98f5b7bdf5133bf2ebb8de6ca77cb
cae79d8ceb527eb8367b1df9e916718e4329d2768ed0b7e61f7c406af9d21f31
d39c5c69570369aba1312477175e799f5a921779b2eb52a85957e5ae47304165
e3f87e59fd8941eb351fda58d6dc02de81968955491239b8e1ca1ad8e05db0ad
+ 144 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  1/10
Tags:
n/a
Link:
https://tria.ge/reports/201026-d3f7v3enre/
Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:Cobalt_functions
Create hunting rule
Author:@j0sm1
Description:Detect functions coded with ROR edi,D; Detect CobaltStrike used by differents groups APT
Rule name:INDICATOR_EXE_Packed_LLVMLoader
Create hunting rule
Author:ditekSHen
Description:Detects LLVM obfuscator/loader

File information

The table below shows additional information about this malware sample such as delivery method and external references.

  
Delivery method
Other
Cape
Cape
https://www.capesandbox.com/analysis/79488/

Comments