MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 94ab2332fe182911723e6700b32842eb8d0cf507e856924656867630ffc45737. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


BazaLoader


Vendor detections: 11


Intelligence 11 IOCs YARA 4 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 94ab2332fe182911723e6700b32842eb8d0cf507e856924656867630ffc45737
SHA3-384 hash: 5bef423721e8e0b17260ba0a88a2417f23721bdc85e43787cfdb66cf798132306b08982868cdaf1af68d93832586fce8
SHA1 hash: f21eff8f7db0dca4bf2dec6fe1104f4521171135
MD5 hash: d99bc67d71816b64838e79977353e4c7
humanhash: virginia-bluebird-bluebird-sodium
File name:Citiswiftcopy024.exe
Download: download sample
Signature BazaLoader
Create hunting rule
File size:1'239'552 bytes
First seen:2024-02-27 11:42:48 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash cc2b3e63a50ba98c3412285dee7a8f0b (16 x AgentTesla, 5 x RemcosRAT, 3 x 404Keylogger)
ssdeep 24576:xqDEvCTbMWu7rQYlBQcBiT6rpFd+zJyiqO6qK1fn7V:xTvC/MTQYxsWPkzJd9Jyn
Threatray 2'548 similar samples on MalwareBazaar
TLSH T13645BF0373818063FF9B92334F96E6115ABD69270123E61F13A81D7ABA705F1563E7B2
TrID 52.2% (.CPL) Windows Control Panel Item (generic) (57583/11/19)
24.0% (.EXE) Win32 EXE Yoda's Crypter (26569/9/4)
9.5% (.EXE) Win64 Executable (generic) (10523/12/4)
4.5% (.EXE) Win16 NE executable (generic) (5038/12/1)
4.0% (.EXE) Win32 Executable (generic) (4504/4/1)
File icon (PE):PE icon
dhash icon 8c129252dac82482 (2 x BazaLoader)
Reporter adrian__luca
Tags:BazaLoader exe

Intelligence

File Origin
# of uploads :
1
# of downloads :
321
Origin country :
HU HU
Vendor Threat Intelligence
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/477968/
Detection(s):
PUA.Win.Packer.Ep-7
Create hunting rule

PUA.Win.Packer.Embedpe-3
Create hunting rule

PUA.Win.Packer.AcprotectUltraprotect-1
Create hunting rule

SecuriteInfo.com.Trojan.Generic.33203615.28472.17882.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Searching for the window
Verdict:
Likely Malicious
Threat level:
  7.5/10
Confidence:
100%
Tags:
autoit fingerprint keylogger lolbin packed shell32
Link:
https://www.filescan.io/uploads/65ddcadd26f1ddc579ac13c0/reports/8b8166b7-2753-4659-b460-69b3c666c83d/overview
Verdict:
Malicious
Labled as:
Malware
Link:
https://www.hybrid-analysis.com/sample/94ab2332fe182911723e6700b32842eb8d0cf507e856924656867630ffc45737
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Verdict:
Unknown
Link:
https://analyze.intezer.com/analyses/3113e516-1c95-4bc1-b9d9-bbdb5814c468
Result
Threat name:
n/a
Detection:
malicious
Classification:
n/a
Score:
64 / 100
Link:
https://www.joesandbox.com/analysis/1399405
Signature
Binary is likely a compiled AutoIt script file
Icon mismatch, binary includes an icon from a different legit application in order to fool users
Machine Learning detection for sample
Multi AV Scanner detection for submitted file
Behaviour
Behavior Graph:
Download SVG
Score:
100%
Verdict:
Malware
File Type:
PE
Link:
https://malprob.io/report/94ab2332fe182911723e6700b32842eb8d0cf507e856924656867630ffc45737
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/94ab2332fe182911723e6700b32842eb8d0cf507e856924656867630ffc45737/
Threat name:
Win32.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2024-02-27 12:18:07 UTC
AV detection:
17 of 24 (70.83%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=ssvsgmx6daurc4r6m4algkcc5ogqz5ih5bljerswqz3db76ek43q._file
Verdict:
unknown
Similar samples:
39a8c585d60201261bad7600af0f3840fcb174fec63263ebf55020e4dedc157c
BazaLoader
44d85e7e0e05ce06956da634a3f19633f1393bf7f82f1faef84e2c4e9d57af5a
BazaLoader
4860fc17275eb07503f1a0def576d46e0be1eb29edb120891be9524b4ea2d986
BazaLoader
4b8896554332d025010afb7c2d634ae9ff5294433f534652aa1cf0cf2a0b1ac1
BazaLoader
4c7a81c3727017a39bb162b64e75574f93179ad68488dde26c9d1a762a387f70
BazaLoader
94ab2332fe182911723e6700b32842eb8d0cf507e856924656867630ffc45737
BazaLoader
97efe91fe5eff3dcdcb055f037f1df01c1409e6bd38a8f07170ea53a0ff265ef
BazaLoader
c56085ee871e8eea85eb269f98c711fd2f7a395f5b054309a0e59047f9605ead
BazaLoader
+ 2'538 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  5/10
Tags:
n/a
Link:
https://tria.ge/reports/240227-nvlqpsgc8z/
Unpacked files
SH256 hash:
3ca5f06b729bbdd39a2753bc9b7368c1da61e4d027c2f572efba0fc80ecf176a
MD5 hash:
fe2107105f4e95273908099b447161bb
SHA1 hash:
c8d24056521f6c0344288291e59b93e547175495
Detections:
win_agent_tesla_g2
Create hunting rule
INDICATOR_SUSPICIOUS_EXE_Referenfces_File_Transfer_Clients
Create hunting rule
Agenttesla_type2
Create hunting rule
INDICATOR_SUSPICIOUS_Binary_References_Browsers
Create hunting rule
INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID
Create hunting rule
INDICATOR_SUSPICIOUS_EXE_References_Messaging_Clients
Create hunting rule
INDICATOR_SUSPICIOUS_EXE_SandboxHookingDLL
Create hunting rule
INDICATOR_EXE_Packed_GEN01
Create hunting rule
INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store
Create hunting rule
Link:
https://www.unpac.me/results/8b406529-2dcf-41f7-b6b4-8c7437714fe0/
SH256 hash:
167c7c2809c96d4095ae6f53f08aba52819d59e6565b0dd7bcafd5b3e7043de9
MD5 hash:
c7cd792e7a43fbc136909ed2aadf1f9b
SHA1 hash:
4b284dd9179e120c75a42eef2244d37157df2e6e
Detections:
win_agent_tesla_g2
Create hunting rule
INDICATOR_SUSPICIOUS_EXE_Referenfces_File_Transfer_Clients
Create hunting rule
Agenttesla_type2
Create hunting rule
INDICATOR_SUSPICIOUS_Binary_References_Browsers
Create hunting rule
INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID
Create hunting rule
INDICATOR_SUSPICIOUS_EXE_References_Messaging_Clients
Create hunting rule
INDICATOR_SUSPICIOUS_EXE_SandboxHookingDLL
Create hunting rule
INDICATOR_EXE_Packed_GEN01
Create hunting rule
INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store
Create hunting rule
Link:
https://www.unpac.me/results/8b406529-2dcf-41f7-b6b4-8c7437714fe0/
Parent samples :
8fa9cd6f74828785bb2a78f6b52ed6be7dd2a205c9ea8163f721f0b66681c92e
94ab2332fe182911723e6700b32842eb8d0cf507e856924656867630ffc45737
a225b14bc9d3330a0ced397bd815633e6918449ac8213c90c00261350925b5cb
SH256 hash:
94ab2332fe182911723e6700b32842eb8d0cf507e856924656867630ffc45737
MD5 hash:
d99bc67d71816b64838e79977353e4c7
SHA1 hash:
f21eff8f7db0dca4bf2dec6fe1104f4521171135
Detections:
AutoIT_Compiled
Create hunting rule
Link:
https://www.unpac.me/results/8b406529-2dcf-41f7-b6b4-8c7437714fe0/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/94ab2332fe182911723e6700b32842eb8d0cf507e856924656867630ffc45737

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:AutoIT_Compiled
Create hunting rule
Author:@bartblaze
Description:Identifies compiled AutoIT script (as EXE). This rule by itself does NOT necessarily mean the detected file is malicious.
Rule name:BazaSpacedDaisy
Create hunting rule
Rule name:DebuggerCheck__API
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:maldoc_find_kernel32_base_method_1
Create hunting rule
Author:Didier Stevens (https://DidierStevens.com)

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

BazaLoader

Executable exe 94ab2332fe182911723e6700b32842eb8d0cf507e856924656867630ffc45737

(this sample)

  
Delivery method
Distributed via e-mail attachment
Cape
Cape
https://www.capesandbox.com/analysis/477968/

Comments