MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 a75eed2248226fdf4940c516c34bba62cd9e441de8b964d36a9485efe2a4053b. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


BazaLoader


Vendor detections: 5


Intelligence 5 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: a75eed2248226fdf4940c516c34bba62cd9e441de8b964d36a9485efe2a4053b
SHA3-384 hash: b6fbf6c61e7ecc0496eeaaead03349584d6aa38b7978d2034d10906aea3cca6b1c006e94eb392c8676d4ebceed22035c
SHA1 hash: c42f477475bba558b98e21f0180ca673069cdf35
MD5 hash: 41da40d696aff915b99f69a73b2c8d39
humanhash: vermont-mike-vermont-vermont
File name:crNfx3f2H.dll
Download: download sample
Signature BazaLoader
Create hunting rule
File size:194'048 bytes
First seen:2021-09-13 15:58:33 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash 2e693c451958293f4a91702375b1fcab (2 x BazaLoader)
ssdeep 3072:XXwq1u2IQ0uefvtPVacfySloSSSCSt2zeZDSSSSSSSSSSSSSSSSSSSSSSSxsCPoH:XXwSulfUSloSSSCSt2zeZDSSSSSSSSSU
Threatray 1 similar samples on MalwareBazaar
TLSH T1BC149E07B2ED10F9D4ABD07CC31B19AAAE7174996B11B76F17E413302D71AA4BB0F648
Reporter AndreGironda
Tags:BazarBackdoor dll

Intelligence

File Origin
# of uploads :
1
# of downloads :
190
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
crNfx3f2H.dll
Verdict:
No threats detected
Analysis date:
2021-09-13 16:04:10 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/fbb954b8-07a7-4eb5-b5a0-8b00df69e643

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Result
Verdict:
Clean
Maliciousness:

Behaviour
Launching the default Windows debugger (dwwin.exe)
Verdict:
Suspicious
Threat level:
  5/10
Confidence:
100%
Tags:
anti-debug monero packed
Link:
https://www.filescan.io/uploads/617503629a5a1e91c5d1fd26/reports/418cdd94-a926-4ea4-bdae-24482919d693/overview
Verdict:
Unknown
Link:
https://analyze.intezer.com/analyses/d2a54ce8-bbca-4137-9d87-0b79baff5c23
Result
Threat name:
Unknown
Detection:
malicious
Classification:
n/a
Score:
52 / 100
Link:
https://www.joesandbox.com/analysis/849966
Signature
Sigma detected: CobaltStrike Load by Rundll32
Sigma detected: Regsvr32 Command Line Without DLL
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 482410 Sample: crNfx3f2H.dll Startdate: 13/09/2021 Architecture: WINDOWS Score: 52 43 Sigma detected: CobaltStrike Load by Rundll32 2->43 45 Sigma detected: Regsvr32 Command Line Without DLL 2->45 8 loaddll64.exe 1 2->8         started        process3 process4 10 iexplore.exe 2 85 8->10         started        12 cmd.exe 1 8->12         started        14 regsvr32.exe 8->14         started        16 7 other processes 8->16 process5 18 iexplore.exe 5 145 10->18         started        21 rundll32.exe 12->21         started        23 WerFault.exe 17 9 14->23         started        25 WerFault.exe 9 16->25         started        27 WerFault.exe 16->27         started        29 WerFault.exe 16->29         started        31 3 other processes 16->31 dnsIp6 35 tls13.taboola.map.fastly.net 151.101.1.44, 443, 49818, 49819 FASTLYUS United States 18->35 37 geolocation.onetrust.com 104.20.184.68, 443, 49762, 49763 CLOUDFLARENETUS United States 18->37 41 9 other IPs or domains 18->41 33 WerFault.exe 20 9 21->33         started        39 192.168.2.1 unknown unknown 23->39 process7
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/a75eed2248226fdf4940c516c34bba62cd9e441de8b964d36a9485efe2a4053b/
Threat name:
Win64.Trojan.Bazarloader
Create hunting rule
Status:
Malicious
First seen:
2021-09-13 15:59:13 UTC
AV detection:
16 of 28 (57.14%)
Threat level:
  5/5
Verdict:
unknown
Similar samples:
72322a8878b2f8df066d2f3b1d6bc53d8dd53a6287c3e65281a6eb5d74bffee0
BazaLoader
Result
Malware family:
n/a
Score:
  10/10
Tags:
n/a
Link:
https://tria.ge/reports/210913-te3beahbcr/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Program crash
Suspicious use of NtCreateProcessExOtherParentProcess
Unpacked files
SH256 hash:
a75eed2248226fdf4940c516c34bba62cd9e441de8b964d36a9485efe2a4053b
MD5 hash:
41da40d696aff915b99f69a73b2c8d39
SHA1 hash:
c42f477475bba558b98e21f0180ca673069cdf35
Link:
https://www.unpac.me/results/b58b6d83-c400-4c1c-afde-c9f76f0c9dd1/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/a75eed2248226fdf4940c516c34bba62cd9e441de8b964d36a9485efe2a4053b

File information

The table below shows additional information about this malware sample such as delivery method and external references.

f692de5772c7123c84cbcf3cbd8177e321b2e6252b25491f91126c432bc6bb87

BazaLoader

Word file doc 330f1da454bce0a5b16245971a404c629ebe272524dc01ce46605556cd15191b

BazaLoader

HTML Application (hta) hta d869fccdb3807528fb62cabc388d4ad9da641fc3354c4432ce2a93ce99e43d3c

BazaLoader

Executable exe a75eed2248226fdf4940c516c34bba62cd9e441de8b964d36a9485efe2a4053b

(this sample)

BazaLoader

Executable exe 2e8fabb2630aa1cb967d2833917ee7b67c95277ac7fe4ecc25d36cdc670abf95

Cape
Cape
https://capesandbox.com/analysis/187506/
  
Dropping
SHA256 2e8fabb2630aa1cb967d2833917ee7b67c95277ac7fe4ecc25d36cdc670abf95
  
Dropped by
SHA256 d869fccdb3807528fb62cabc388d4ad9da641fc3354c4432ce2a93ce99e43d3c
  
Delivery method
Distributed via web download

Comments