MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 976ef5ced7cc6b4d30a7eed5d427dcbc70b4c14403dd53fc1caa7c5b9ac9200f. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 5


Intelligence 5 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 976ef5ced7cc6b4d30a7eed5d427dcbc70b4c14403dd53fc1caa7c5b9ac9200f
SHA3-384 hash: d506bbd19354592b6c1e776eda1444dc6121f06a08611ddb5fce9fcdf308b7005e769b364e4061431de1a202a30e4f7d
SHA1 hash: c268fd858ed63f86db2ffdaa2152899644d9089f
MD5 hash: 879a49e9e25979eabc75e2cd13ccd28e
humanhash: zulu-enemy-december-victor
File name:slwsec.dll
Download: download sample
File size:528'384 bytes
First seen:2021-12-03 15:56:55 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash 8395f12ea47bc4f646f0b95c7954cc01
ssdeep 12288:E2fZti/my1x0W9g35i1PjOMoLojXPX/BA2:9Zt5YO35i17OMao7na2
Threatray 40 similar samples on MalwareBazaar
TLSH T1F7B49E19FAA804B5E166D03889778586E7727C9907A0D7EF2368532E1F33FE05E3A711
Reporter Anonymous
Tags:exe

Intelligence

File Origin
# of uploads :
1
# of downloads :
234
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
slwsec.dll
Verdict:
No threats detected
Analysis date:
2021-12-03 17:10:06 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/085bf021-9fbe-4d20-8c5b-4f7ecaf34cc1

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/211082/
Result
Verdict:
Clean
Maliciousness:

Behaviour
DNS request
Verdict:
Suspicious
Threat level:
  5/10
Confidence:
100%
Tags:
greyware packed
Link:
https://www.filescan.io/uploads/61aa3e5f4d8e6f3a5e0d8032/reports/a90f0ff8-57ce-4c8b-a378-f5fe132e8ec0/overview
Result
Verdict:
UNKNOWN
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Verdict:
Suspicious
Link:
https://analyze.intezer.com/analyses/db30c8dc-1950-49ad-959b-b419cda4d0cc
Result
Threat name:
Unknown
Detection:
malicious
Classification:
troj.evad
Score:
52 / 100
Link:
https://www.joesandbox.com/analysis/900990
Signature
Tries to detect virtualization through RDTSC time measurements
Uses ping.exe to check the status of other devices and networks
Uses ping.exe to sleep
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 process2 2 Behavior Graph ID: 533497 Sample: slwsec.dll Startdate: 03/12/2021 Architecture: WINDOWS Score: 52 7 loaddll64.exe 1 2->7         started        signatures3 35 Tries to detect virtualization through RDTSC time measurements 7->35 10 cmd.exe 1 7->10         started        13 rundll32.exe 7->13         started        15 rundll32.exe 7->15         started        17 rundll32.exe 7->17         started        process4 signatures5 37 Uses ping.exe to sleep 10->37 39 Uses ping.exe to check the status of other devices and networks 10->39 19 rundll32.exe 10->19         started        21 cmd.exe 1 13->21         started        41 Tries to detect virtualization through RDTSC time measurements 15->41 process6 signatures7 33 Uses ping.exe to sleep 21->33 24 PING.EXE 1 21->24         started        27 rundll32.exe 21->27         started        29 conhost.exe 21->29         started        process8 dnsIp9 31 127.0.0.1 unknown unknown 24->31
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/976ef5ced7cc6b4d30a7eed5d427dcbc70b4c14403dd53fc1caa7c5b9ac9200f/
Threat name:
Win64.Trojan.Bazaloader
Create hunting rule
Status:
Suspicious
First seen:
2021-12-03 15:57:17 UTC
File Type:
PE+ (Dll)
Extracted files:
4
AV detection:
14 of 28 (50.00%)
Threat level:
  5/5
Verdict:
unknown
Similar samples:
22e899eddfcdd250f184f10d71b117c2b6a1625847ba5c46c39ee6245afc1ef2
58bef95d2f1dc3d23b16d982a452e982d4812eee455bc90b2c8694e5e58eec28
69c6638c277af7f94f34c6f1ea1cee9d7cf5ee7a1e8ef0d2df527f8d6a529f5f
6a852c0f5d6e5f124298d47ec6800100bfd886b6196a722bced61f267b497a7d
7883df070b501cf6d4f167ac030820d2fa5d90bd6f48b7feacbe17e612e0475b
83eebca023e0700c5d40cc90fd9fedba3523b8f4e4012a6427e2d8c644a6eb84
880e2c5548284e08c44028f419a98350fa58e9f758a57f4ddb7b5d6e48fc7eb9
b163e34d8490c0b567d788e997d9693c9da120a21dff06de9d400c6e66386437
bec7fb70521beab8f861f0d0c5c2996c48bd26626546b12d8c08265dcbc546d7
f0718e4578b67fc0c73b03762a91abd62a071758074ac8f108a00c4cf612474f
+ 30 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  10/10
Tags:
n/a
Link:
https://tria.ge/reports/211203-tdya3aghhq/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Program crash
Suspicious use of NtCreateProcessExOtherParentProcess
Unpacked files
SH256 hash:
976ef5ced7cc6b4d30a7eed5d427dcbc70b4c14403dd53fc1caa7c5b9ac9200f
MD5 hash:
879a49e9e25979eabc75e2cd13ccd28e
SHA1 hash:
c268fd858ed63f86db2ffdaa2152899644d9089f
Link:
https://www.unpac.me/results/f4199907-280a-483a-a341-f8fbc8fbbec6/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/976ef5ced7cc6b4d30a7eed5d427dcbc70b4c14403dd53fc1caa7c5b9ac9200f

File information

The table below shows additional information about this malware sample such as delivery method and external references.

  
Delivery method
Distributed via e-mail link
Cape
Cape
https://www.capesandbox.com/analysis/211082/

Comments