MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 9b7bdb4cb71e84c5cff0923928bf7777a41cb5e0691810ae948304c151c0c1c5. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


BazaLoader


Vendor detections: 13


Intelligence 13 IOCs YARA 11 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 9b7bdb4cb71e84c5cff0923928bf7777a41cb5e0691810ae948304c151c0c1c5
SHA3-384 hash: 85cc25b83d2633f07070d38f494c4f1786e8150d3eaa8ed3589c27a827138dfdb576387a0071115f05d0b1fcc9e1c477
SHA1 hash: 768f8a179fee1f13505c7b772e543b19b29b14c8
MD5 hash: 70b599f67e97cb878ca7be88e069a82d
humanhash: november-alaska-carpet-five
File name:capisp.dll
Download: download sample
Signature BazaLoader
Create hunting rule
File size:1'244'160 bytes
First seen:2024-07-01 13:04:20 UTC
Last seen:2024-07-01 13:21:40 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash 86e834d3d61509ce2f47957bd2f89dc1 (1 x BazaLoader)
ssdeep 24576:h2sNbyXYH2FWaJHnvpTLLs7e1G1oKEnUiiiziiiziiiciiicQ7r3PZQs:hxN+XYH2wadvpTLLsQKKr3P
TLSH T16D455C1BE3A355E8C66FC1348797D772BA30B8694134BE6F1AA4D7221F10D609F2E724
TrID 41.1% (.EXE) Microsoft Visual C++ compiled executable (generic) (16529/12/5)
26.1% (.EXE) Win64 Executable (generic) (10523/12/4)
12.5% (.EXE) Win16 NE executable (generic) (5038/12/1)
5.1% (.ICL) Windows Icons Library (generic) (2059/9)
5.0% (.EXE) OS/2 Executable (generic) (2029/13)
Reporter Anonymous
Tags:BazaLoader exe

Intelligence

File Origin
# of uploads :
2
# of downloads :
404
Origin country :
US US
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
neuro.msi
Verdict:
Malicious activity
Analysis date:
2024-06-28 09:07:59 UTC
Tags:
latrodectus
Link:
https://app.any.run/tasks/189e1a2e-af88-43fe-a61a-a872e9aa55a2

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection(s):
SecuriteInfo.com.Win64.DropperX-gen.17130.159.UNOFFICIAL
Create hunting rule

Verdict:
Malicious
Score:
97.4%
Link:
https://cyber-fortress.com/docs/result/index.php?id=6682a9ae4aef5fb03e2ed4c6win10vpnfull_triage
Tags:
Generic Infostealer Network Stealth
Result
Verdict:
Clean
Maliciousness:
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
crypto masquerade mingw packed peloader
Link:
https://www.filescan.io/uploads/6682a9880bf5978c0b13ef80/reports/6c9ab9cf-2731-4356-afec-ff15a04d1c0c/overview
Verdict:
Malicious
Labled as:
Trojan.Generic
Link:
https://www.hybrid-analysis.com/sample/9b7bdb4cb71e84c5cff0923928bf7777a41cb5e0691810ae948304c151c0c1c5
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Verdict:
Unknown
Link:
https://analyze.intezer.com/analyses/0b35f1d4-5209-4767-a7b0-4d39863c22e0
Result
Threat name:
Bazar Loader, BruteRatel, Latrodectus
Create hunting rule
Detection:
malicious
Classification:
troj.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1465338
Signature
AI detected suspicious sample
Allocates memory in foreign processes
Antivirus detection for URL or domain
C2 URLs / IPs found in malware configuration
Contains functionality to inject threads in other processes
Creates a thread in another existing process (thread injection)
Found malware configuration
Injects a PE file into a foreign processes
Injects code into the Windows Explorer (explorer.exe)
Modifies the context of a thread in another process (thread injection)
Multi AV Scanner detection for submitted file
Sample uses string decryption to hide its real strings
Sets debug register (to hijack the execution of another thread)
Sigma detected: RunDLL32 Spawning Explorer
System process connects to network (likely due to code injection or exploit)
Writes to foreign memory regions
Yara detected Bazar Loader
Yara detected BruteRatel
Yara detected Latrodectus
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1465338 Sample: capisp.dll.exe Startdate: 01/07/2024 Architecture: WINDOWS Score: 100 41 prodetanoes.com 2->41 43 garunt.biz 2->43 45 3 other IPs or domains 2->45 57 Found malware configuration 2->57 59 Antivirus detection for URL or domain 2->59 61 Multi AV Scanner detection for submitted file 2->61 63 7 other signatures 2->63 10 loaddll64.exe 1 2->10         started        signatures3 process4 process5 12 rundll32.exe 12 10->12         started        16 cmd.exe 1 10->16         started        18 rundll32.exe 12 10->18         started        20 5 other processes 10->20 dnsIp6 53 bibidj.biz 74.119.194.126, 443, 49705, 49706 MOVECLICKLLCUS United States 12->53 73 Contains functionality to inject threads in other processes 12->73 75 Injects code into the Windows Explorer (explorer.exe) 12->75 77 Sets debug register (to hijack the execution of another thread) 12->77 85 3 other signatures 12->85 22 rundll32.exe 1 12 16->22         started        55 barsman.biz 94.232.249.102, 443, 49716, 49737 INT-PDN-STE-ASSTEPDNInternalASSY Syrian Arab Republic 18->55 79 System process connects to network (likely due to code injection or exploit) 18->79 81 Writes to foreign memory regions 18->81 83 Allocates memory in foreign processes 18->83 26 WerFault.exe 20 16 20->26         started        28 WerFault.exe 16 20->28         started        30 WerFault.exe 20->30         started        32 WerFault.exe 20->32         started        signatures7 process8 dnsIp9 51 garunt.biz 94.232.249.103, 443, 49735, 49736 INT-PDN-STE-ASSTEPDNInternalASSY Syrian Arab Republic 22->51 65 System process connects to network (likely due to code injection or exploit) 22->65 67 Injects code into the Windows Explorer (explorer.exe) 22->67 69 Writes to foreign memory regions 22->69 71 4 other signatures 22->71 34 explorer.exe 93 2 22->34 injected signatures10 process11 dnsIp12 47 prodetanoes.com 103.144.139.160, 443, 49742, 49746 GIGABIT-MYGigabitHostingSdnBhdMY unknown 34->47 49 finjuiceer.com 184.174.96.179, 443, 49740, 49745 DIGITALPACIFIC-AUDigitalPacificPtyLtdAustraliaAU United States 34->49 37 rundll32.exe 34->37         started        39 rundll32.exe 34->39         started        process13
Score:
20%
Verdict:
Benign
File Type:
PE
Link:
https://malprob.io/report/9b7bdb4cb71e84c5cff0923928bf7777a41cb5e0691810ae948304c151c0c1c5
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/9b7bdb4cb71e84c5cff0923928bf7777a41cb5e0691810ae948304c151c0c1c5/
Threat name:
Win64.Trojan.Latrodectus
Create hunting rule
Status:
Malicious
First seen:
2024-06-24 20:42:26 UTC
File Type:
PE+ (Dll)
AV detection:
16 of 24 (66.67%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=tn55wtfxd2cmlt7qsi4srp3xo6sbznpanembbluuqmcmcuoayhcq._file
Verdict:
malicious
Result
Malware family:
n/a
Score:
  8/10
Tags:
n/a
Link:
https://tria.ge/reports/240701-qbhaaawgnk/
Behaviour
Modifies system certificate store
Suspicious behavior: EnumeratesProcesses
Blocklisted process makes network request
Verdict:
Suspicious
Tags:
n/a
YARA:
n/a
Link:
https://app.threat.zone/submission/51739226-4b55-4130-a28f-8157eb5e5b13
Unpacked files
SH256 hash:
4966d0934c3fd030bb704b4a67cd9e0fc31addc11a591676d64e059e46d2c4c7
MD5 hash:
9b6ec80cdaca179aff0d665a595daba6
SHA1 hash:
a09c3f8d1eaa1b495ab6299eb534f5aeb93b98cd
Detections:
win_bazarbackdoor_auto
Create hunting rule
win_brute_ratel_c4_a0
Create hunting rule
Link:
https://www.unpac.me/results/8a4a09f3-a6ea-4890-8158-1a905756b640/
SH256 hash:
9b7bdb4cb71e84c5cff0923928bf7777a41cb5e0691810ae948304c151c0c1c5
MD5 hash:
70b599f67e97cb878ca7be88e069a82d
SHA1 hash:
768f8a179fee1f13505c7b772e543b19b29b14c8
Link:
https://www.unpac.me/results/8a4a09f3-a6ea-4890-8158-1a905756b640/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/9b7bdb4cb71e84c5cff0923928bf7777a41cb5e0691810ae948304c151c0c1c5

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:Check_OutputDebugStringA_iat
Create hunting rule
Rule name:DebuggerCheck__API
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:maldoc_getEIP_method_1
Create hunting rule
Author:Didier Stevens (https://DidierStevens.com)
Rule name:malware_shellcode_hash
Create hunting rule
Author:JPCERT/CC Incident Response Group
Description:detect shellcode api hash value
Rule name:MD5_Constants
Create hunting rule
Author:phoul (@phoul)
Description:Look for MD5 constants
Rule name:meth_get_eip
Create hunting rule
Author:Willi Ballenthin
Rule name:QbotStuff
Create hunting rule
Author:anonymous
Rule name:SEH__vectored
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:ThreadControl__Context
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:Windows_Trojan_BruteRatel_4110d879
Create hunting rule
Author:Elastic Security
Rule name:win_bazarbackdoor_auto
Create hunting rule
Author:Felix Bilstein - yara-signator at cocacoding dot com
Description:Detects win.bazarbackdoor.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

BLint

The following table provides more information about this file using BLint. BLint is a Binary Linter to check the security properties, and capabilities in executables.

Findings
IDTitleSeverity
CHECK_AUTHENTICODEMissing Authenticodehigh
CHECK_DLL_CHARACTERISTICSMissing dll Security Characteristics (NX_COMPAT)high
CHECK_NXMissing Non-Executable Memory Protectioncritical
CHECK_PIEMissing Position-Independent Executable (PIE) Protectionhigh
Reviews
IDCapabilitiesEvidence
WIN32_PROCESS_APICan Create Process and ThreadsKERNEL32.dll::OpenProcess
KERNEL32.dll::CloseHandle
WIN_BASE_APIUses Win Base APIKERNEL32.dll::TerminateProcess
KERNEL32.dll::LoadLibraryW
WIN_CRYPT_APIUses Windows Crypt APIADVAPI32.dll::CryptAcquireContextA
ADVAPI32.dll::CryptGenRandom
WIN_SOCK_APIUses Network to send and receive dataWS2_32.dll::bind
WS2_32.dll::closesocket
WS2_32.dll::connect
WS2_32.dll::freeaddrinfo
WS2_32.dll::getaddrinfo
WS2_32.dll::getsockname

Comments