MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 951d92a848709c99656328efbc427caca665727b51e455776f67fa3cbab37c94. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


BazaLoader


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 951d92a848709c99656328efbc427caca665727b51e455776f67fa3cbab37c94
SHA3-384 hash: 4ee1c7fb0bd946cfd631f193ed0f4611f454947292c62f5e97910b781b4313b0336597c46dec824812bae99c113149ad
SHA1 hash: 45173914ee926c48e9d5fbcce39813ee40332e97
MD5 hash: 6b38bff5aec8823d2b8f81437df13766
humanhash: mobile-violet-high-dakota
File name:SecuriteInfo.com.Generic.mg.6b38bff5aec8823d.16192
Download: download sample
Signature BazaLoader
Create hunting rule
File size:1'042'985 bytes
First seen:2021-02-09 22:52:58 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash b4fde864c45f66c378efc2bedd98550f (17 x BazaLoader)
ssdeep 6144:do3pwmXC25RIyX4db7SvNJnxPGpvSiyS:ddmy2X4d
Threatray 10 similar samples on MalwareBazaar
TLSH 9C257B1B72E434FCE066D634C9904245EBB5743507768FAF03E886A92F536A1AD7EB30
Reporter SecuriteInfoCom
Tags:BazaLoader

Intelligence

File Origin
# of uploads :
1
# of downloads :
117
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
SecuriteInfo.com.Generic.mg.6b38bff5aec8823d.16192
Verdict:
No threats detected
Analysis date:
2021-02-09 23:06:19 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/7a739d0c-c1fe-42a9-a59e-08c480d6de1a

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/116345/
Detection(s):
SecuriteInfo.com.Generic.mg.6b38bff5aec8823d.16192.UNOFFICIAL
Create hunting rule

SecuriteInfo.com.Artemis018048AA9219.28755.UNOFFICIAL
Create hunting rule

Result
Verdict:
Clean
Maliciousness:

Behaviour
Sending a UDP request
Result
Verdict:
UNKNOWN
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Result
Threat name:
Unknown
Detection:
malicious
Classification:
troj.evad
Score:
80 / 100
Link:
https://www.joesandbox.com/analysis/603708
Signature
Machine Learning detection for dropped file
Machine Learning detection for sample
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)
Uses ping.exe to check the status of other devices and networks
Uses ping.exe to sleep
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 350853 Sample: SecuriteInfo.com.Generic.mg... Startdate: 09/02/2021 Architecture: WINDOWS Score: 80 65 Snort IDS alert for network traffic (e.g. based on Emerging Threat rules) 2->65 67 Multi AV Scanner detection for submitted file 2->67 69 Uses ping.exe to sleep 2->69 71 2 other signatures 2->71 11 SecuriteInfo.com.Generic.mg.6b38bff5aec8823d.exe 2->11         started        13 plnhcdkegimr.exe 2->13         started        15 plnhcdkegimr.exe 2->15         started        process3 process4 17 cmd.exe 1 11->17         started        dnsIp5 59 127.0.0.1 unknown unknown 17->59 73 Uses ping.exe to sleep 17->73 21 SecuriteInfo.com.Generic.mg.6b38bff5aec8823d.exe 3 17->21         started        24 conhost.exe 17->24         started        26 PING.EXE 1 17->26         started        signatures6 process7 file8 55 C:\Users\user\AppData\...\plnhcdkegimr.exe, PE32+ 21->55 dropped 57 C:\Users\...\plnhcdkegimr.exe:Zone.Identifier, ASCII 21->57 dropped 28 cmd.exe 1 21->28         started        31 cmd.exe 1 21->31         started        33 cmd.exe 1 21->33         started        process9 signatures10 79 Uses ping.exe to sleep 28->79 35 plnhcdkegimr.exe 28->35         started        39 PING.EXE 1 28->39         started        41 conhost.exe 28->41         started        43 conhost.exe 31->43         started        45 reg.exe 1 1 31->45         started        47 conhost.exe 33->47         started        process11 dnsIp12 61 52.37.89.225, 443, 49723, 49741 AMAZON-02US United States 35->61 75 Multi AV Scanner detection for dropped file 35->75 77 Machine Learning detection for dropped file 35->77 49 cmd.exe 1 35->49         started        63 192.168.2.1 unknown unknown 39->63 signatures13 process14 process15 51 conhost.exe 49->51         started        53 reg.exe 1 49->53         started       
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/951d92a848709c99656328efbc427caca665727b51e455776f67fa3cbab37c94/
Threat name:
Win64.Trojan.Wacatac
Create hunting rule
Status:
Malicious
First seen:
2021-02-09 21:31:51 UTC
AV detection:
17 of 29 (58.62%)
Threat level:
  5/5
Verdict:
unknown
Similar samples:
375cb8f99ca2f56c79bf1e632ef30b4bfd20866ca47c028688bab9fa20c69320
BazaLoader
502985c35a5b440dfc18d5dc12e524726567311ebabe35cddde961acbe718cbb
BazaLoader
52b441ab29135703146fdd5d75db3b0e441c9bc187a8df4e6201a033edd0b8de
BazaLoader
5779383242bc52dd737295a5f802288cb19bb3d44a8f85c3c0a806c99d6e215d
BazaLoader
5cb9b33ca105d1f74a81fc104a8f6054c8db69f5c20091de74f877a75deceea6
BazaLoader
63b65aa8b297247365df8d10efb7e3645ccb561b74c78690db76905a584b2c26
BazaLoader
76cdb9f1dd635489d8cf6cb294fe5805c95a090c6cf00aafe1a8a397da3b1f03
BazaLoader
cefdcb4e5cac9b1bb183f667b39deac6bffa0337e61e4e0a323f712f168accc6
BazaLoader
df1e5e50ded27dafde6819a5dd685c435175a14def9f1aacc1d6a7aeb5fff662
BazaLoader
e0f0d4358a6f0c5a8b64bace8756e26086eee10ae7830c864c6b500bcc31b581
BazaLoader
Result
Malware family:
n/a
Score:
  1/10
Tags:
n/a
Link:
https://tria.ge/reports/210209-pg5ta75xhs/
Behaviour
Runs ping.exe
Suspicious use of WriteProcessMemory
Unpacked files
SH256 hash:
951d92a848709c99656328efbc427caca665727b51e455776f67fa3cbab37c94
MD5 hash:
6b38bff5aec8823d2b8f81437df13766
SHA1 hash:
45173914ee926c48e9d5fbcce39813ee40332e97
Link:
https://www.unpac.me/results/0ac1be2a-d5ee-48df-b660-49979505aa27/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Trojan
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/951d92a848709c99656328efbc427caca665727b51e455776f67fa3cbab37c94

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

BazaLoader

Executable exe 951d92a848709c99656328efbc427caca665727b51e455776f67fa3cbab37c94

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/997626/
  
Delivery method
Distributed via web download
Cape
Cape
https://www.capesandbox.com/analysis/116345/

Comments