MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 8f373e1671d5073d0760f1480c561f3e29da7a83fc91f6950ee9e7a80e0dfe52. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


BazaLoader


Vendor detections: 7


Intelligence 7 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 8f373e1671d5073d0760f1480c561f3e29da7a83fc91f6950ee9e7a80e0dfe52
SHA3-384 hash: 098da5e241269673cbdcf9343ad3d0846e5c12e88804da5fd1af6b99e76acdc53b3f7b30e4eb811c4ae3fdaea34a795b
SHA1 hash: e1b35519a5a71beaef1d3de96e60ec9ace59f825
MD5 hash: 0497078f45ba392c13c82104c3bd4556
humanhash: autumn-orange-alpha-april
File name:e1b35519a5a71beaef1d3de96e60ec9ace59f825.dll
Download: download sample
Signature BazaLoader
Create hunting rule
File size:813'581 bytes
First seen:2021-11-23 16:21:16 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash d53c413ff89d1ad0fd374ba2728c9047 (2 x BazaLoader)
ssdeep 6144:GMVvrmD0crjGFcdkEJ+uzx0OjtsQZjDErWdzw9nuD9YceqCCeSFuixAYhEzZRlyN:/vrmD0crjGtgtsQZAWB9WqCiFuWAmk8d
Threatray 66 similar samples on MalwareBazaar
TLSH T1CA057E7E8871051AEEDB08F89CD8BFD9E596666D1F25D4BA5C31E0F03E313B9A806113
Reporter Rony
Tags:BazaLoader BazarLoader dll exe

Intelligence

File Origin
# of uploads :
1
# of downloads :
180
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
e1b35519a5a71beaef1d3de96e60ec9ace59f825.dll
Verdict:
No threats detected
Analysis date:
2021-11-23 16:27:08 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/e5785d8f-aae3-4b39-99c6-8984cc1a9643

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Gathering data
Result
Verdict:
Clean
Maliciousness:

Behaviour
DNS request
Сreating synchronization primitives
Verdict:
Suspicious
Threat level:
  5/10
Confidence:
67%
Tags:
overlay packed
Link:
https://www.filescan.io/uploads/619d152d02c80febc2a73f62/reports/daa62922-4e8f-423b-9aaa-1bc00192ffba/overview
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Verdict:
Suspicious
Link:
https://analyze.intezer.com/analyses/af00af76-1665-4e24-9836-33bb32348cfc
Result
Threat name:
Unknown
Detection:
malicious
Classification:
evad
Score:
76 / 100
Link:
https://www.joesandbox.com/analysis/894901
Signature
Allocates memory in foreign processes
Injects a PE file into a foreign processes
Modifies the context of a thread in another process (thread injection)
Multi AV Scanner detection for submitted file
System process connects to network (likely due to code injection or exploit)
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Writes to foreign memory regions
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 527380 Sample: Q1KL4ickDw.dll Startdate: 23/11/2021 Architecture: WINDOWS Score: 76 34 Multi AV Scanner detection for submitted file 2->34 36 Tries to detect sandboxes and other dynamic analysis tools (process name or module or function) 2->36 8 loaddll64.exe 1 2->8         started        process3 process4 10 cmd.exe 1 8->10         started        12 iexplore.exe 1 73 8->12         started        14 regsvr32.exe 8->14         started        16 3 other processes 8->16 process5 18 rundll32.exe 13 10->18         started        22 iexplore.exe 129 12->22         started        dnsIp6 26 162.33.179.96, 443, 49750 CORENETUS United States 18->26 38 System process connects to network (likely due to code injection or exploit) 18->38 40 Writes to foreign memory regions 18->40 42 Allocates memory in foreign processes 18->42 44 2 other signatures 18->44 24 chrome.exe 18->24         started        28 contextual.media.net 2.18.160.23, 443, 49718, 49719 AKAMAI-ASUS European Union 22->28 30 www.msn.com 22->30 32 web.vortex.data.msn.com 22->32 signatures7 process8
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/8f373e1671d5073d0760f1480c561f3e29da7a83fc91f6950ee9e7a80e0dfe52/
Threat name:
Win64.Spyware.Bazarloader
Create hunting rule
Status:
Suspicious
First seen:
2021-11-19 01:31:03 UTC
File Type:
PE+ (Dll)
Extracted files:
1
AV detection:
14 of 27 (51.85%)
Threat level:
  2/5
Verdict:
malicious
Similar samples:
02c8c4d08cdd2bc230e6ed2676d20867eb4fb733bf254432ac6d339d7406b8f9
BazaLoader
03212850d80dd26f4b6706024516f1834e7b8ae9fc31231b2a624106242c4838
BazaLoader
14cc39c7804ff5f599fc801d763a7973f5a99a0d510327a86b1b3f0f25a8fe49
BazaLoader
46e596461f8ee1fd4d63bd1a2e7366a938e06f19750cfc90a9609edbce7381a1
BazaLoader
485a3c191731de674005bf28bb644672cfcc1bad58abb9b7d0f36d71d2973067
BazaLoader
d1c628414464ca89e07404650c490ca1e3dfab596b4ec603e3811d37f48bbf7c
BazaLoader
dc88a068281fba59a03e3debff037a3b585d5d5f65022d1ecb45bd77fe017de7
BazaLoader
+ 56 additional samples on MalwareBazaar
Result
Malware family:
bazarloader
Create hunting rule
Score:
  10/10
Tags:
family:bazarloader dropper loader
Link:
https://tria.ge/reports/211123-tt8rqsafer/
Behaviour
Bazar/Team9 Loader payload
Bazar Loader
Unpacked files
SH256 hash:
8f373e1671d5073d0760f1480c561f3e29da7a83fc91f6950ee9e7a80e0dfe52
MD5 hash:
0497078f45ba392c13c82104c3bd4556
SHA1 hash:
e1b35519a5a71beaef1d3de96e60ec9ace59f825
Link:
https://www.unpac.me/results/168a6e3a-130a-4626-8c19-276237b9e5d6/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Suspicious File
Score:
0.34
Link:
https://yomi.yoroi.company/submissions/8f373e1671d5073d0760f1480c561f3e29da7a83fc91f6950ee9e7a80e0dfe52

File information

The table below shows additional information about this malware sample such as delivery method and external references.

  
Dropping
BazarBackdoor
Cape
Cape
https://www.capesandbox.com/analysis/208765/

Comments