MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 b9bf11a7d893209e32c7775336a9e55302170701c710c64261908131ecaeae4e. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


BazaLoader


Vendor detections: 7


Intelligence 7 IOCs YARA 8 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: b9bf11a7d893209e32c7775336a9e55302170701c710c64261908131ecaeae4e
SHA3-384 hash: 099f72e840aca9a2147d5769b9366755cfb6bcfe9bf94b3dd87c1c80ec47db00ac16db0889a0075a3d1b1009565b4d80
SHA1 hash: 7f3e0c4ffbea04dfd3a15fcb39bb10666a691350
MD5 hash: 0cebe98c2dc84936ab285eabc94533fc
humanhash: finch-wisconsin-equal-twenty
File name:Document-21-41-00.js
Download: download sample
Signature BazaLoader
Create hunting rule
File size:1'198'811 bytes
First seen:2024-09-20 22:04:30 UTC
Last seen:Never
File type:Java Script (JS) js
MIME type:application/json
ssdeep 24576:FzP3PQ82DP3c1kk8HVCMTQXI3HXHnwVsLxQAtREJs:FzP3PQ8cPc1kk8HV5Tr33HwVsLxQAtRv
TLSH T133456B60FA4501261E83579FAC6216D2FD3CD21193022228E9AE439D5F875ECD3BDB7E
TrID 50.6% (.CRYPROJECT) CryEngine Project (generic) (20000/1/7)
31.6% (.PZ2) Poser pose (12500/1/4)
17.7% (.TSS) T'SoundSystem Source (with rem) (7000/1/2)
Magika txt
Reporter k3dg3___
Tags:BazaLoader BruteRatel js Latrodectus

Intelligence

File Origin
# of uploads :
1
# of downloads :
453
Origin country :
US US
Vendor Threat Intelligence
Verdict:
Malicious
Score:
96.5%
Link:
https://cyber-fortress.com/docs/result/index.php?id=66eed2cdf129e67ada90347d
Tags:
Network Stealth
Verdict:
Likely Malicious
Threat level:
  7.5/10
Confidence:
100%
Tags:
cerberus lolbin masquerade remote shell32
Link:
https://www.filescan.io/uploads/66edf18f670eb6e13001acd6/reports/7a00863b-3382-483d-89e8-ad7cf6dfa1e9/overview
Verdict:
Unknown
Link:
https://www.hybrid-analysis.com/sample/b9bf11a7d893209e32c7775336a9e55302170701c710c64261908131ecaeae4e
Result
Verdict:
UNKNOWN
Result
Threat name:
Bazar Loader, BruteRatel, Latrodectus
Create hunting rule
Detection:
malicious
Classification:
evad.spre.troj
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1515101
Signature
Allocates memory in foreign processes
Antivirus detection for URL or domain
C2 URLs / IPs found in malware configuration
Contains functionality to inject threads in other processes
Creates a thread in another existing process (thread injection)
Drops executables to the windows directory (C:\Windows) and starts them
Found malware configuration
Injects a PE file into a foreign processes
Injects code into the Windows Explorer (explorer.exe)
JavaScript file contains Antivirus product strings
Multi AV Scanner detection for domain / URL
Sample uses string decryption to hide its real strings
Sets debug register (to hijack the execution of another thread)
Sigma detected: RunDLL32 Spawning Explorer
Sigma detected: WScript or CScript Dropper
Suricata IDS alerts for network traffic
System process connects to network (likely due to code injection or exploit)
Windows Scripting host queries suspicious COM object (likely to drop second stage)
Writes to foreign memory regions
Wscript install MSI file from remote location
Yara detected Bazar Loader
Yara detected BruteRatel
Yara detected Generic JS Downloader
Yara detected Latrodectus
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1515101 Sample: Document-21-41-00.js Startdate: 21/09/2024 Architecture: WINDOWS Score: 100 39 tiguanin.com 2->39 41 isomicrotich.com 2->41 43 2 other IPs or domains 2->43 55 Multi AV Scanner detection for domain / URL 2->55 57 Suricata IDS alerts for network traffic 2->57 59 Found malware configuration 2->59 61 11 other signatures 2->61 10 msiexec.exe 14 38 2->10         started        15 wscript.exe 1 2->15         started        signatures3 process4 dnsIp5 51 188.119.113.152, 49702, 80 SERVERIUS-ASNL Russian Federation 10->51 31 C:\Windows\Installer\MSI7CB5.tmp, PE32 10->31 dropped 33 C:\Users\user\AppData\Roaming\trezid.dll, PE32+ 10->33 dropped 35 C:\Windows\Installer\MSI7BD8.tmp, PE32 10->35 dropped 37 3 other files (none is malicious) 10->37 dropped 71 Drops executables to the windows directory (C:\Windows) and starts them 10->71 17 MSI7CB5.tmp 1 10->17         started        19 msiexec.exe 10->19         started        73 Windows Scripting host queries suspicious COM object (likely to drop second stage) 15->73 file6 signatures7 process8 process9 21 rundll32.exe 17->21         started        process10 23 rundll32.exe 12 21->23         started        dnsIp11 45 bazarunet.com 193.124.185.116, 49703, 49717, 49724 IHOR-ASRU Russian Federation 23->45 47 tiguanin.com 193.124.185.117, 49704, 49710, 49712 IHOR-ASRU Russian Federation 23->47 49 greshunka.com 92.118.112.130, 49713, 49714, 49719 GUDAEV-ASRU Russian Federation 23->49 63 System process connects to network (likely due to code injection or exploit) 23->63 65 Contains functionality to inject threads in other processes 23->65 67 Injects code into the Windows Explorer (explorer.exe) 23->67 69 5 other signatures 23->69 27 explorer.exe 28 1 23->27 injected signatures12 process13 dnsIp14 53 isomicrotich.com 188.114.96.3, 443, 49733, 49735 CLOUDFLARENETUS European Union 27->53 75 System process connects to network (likely due to code injection or exploit) 27->75 signatures15
Score:
100%
Verdict:
Malware
File Type:
SCRIPT
Link:
https://malprob.io/report/b9bf11a7d893209e32c7775336a9e55302170701c710c64261908131ecaeae4e
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/b9bf11a7d893209e32c7775336a9e55302170701c710c64261908131ecaeae4e/
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=xg7rdj6ysmqj4mwho5jtnkpfkmbbobyby4immqtbscatd3fovzha._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/b9bf11a7d893209e32c7775336a9e55302170701c710c64261908131ecaeae4e

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:Cerberus
Create hunting rule
Author:Jean-Philippe Teissier / @Jipe_
Description:Cerberus
Rule name:Detect_APT29_WINELOADER_Backdoor
Create hunting rule
Author:daniyyell
Description:Detects APT29's WINELOADER backdoor variant used in phishing campaigns, this rule also detect bad pdf,shtml,htm and vbs or maybe more depends
Reference:https://cloud.google.com/blog/topics/threat-intelligence/apt29-wineloader-german-political-parties
Rule name:GuLoader
Create hunting rule
Rule name:RANSOMWARE
Create hunting rule
Author:ToroGuitar
Rule name:unknown_dropper
Create hunting rule
Author:#evilcel3ri
Description:Detects an unknown dropper
Rule name:Warp
Create hunting rule
Author:Seth Hardy
Description:Warp
Rule name:WarpStrings
Create hunting rule
Author:Seth Hardy
Description:Warp Identifying Strings

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

BazaLoader

pdf 249400171cc9f0b0d659138a0a7a529bb27b01ce1b5c755e274a9cb8fab15260

BazaLoader

Java Script (JS) js b9bf11a7d893209e32c7775336a9e55302170701c710c64261908131ecaeae4e

(this sample)

BruteRatel

Microsoft Software Installer (MSI) msi c3f8ebc9cfb7ebe1ebbe3a4210753b271fecf73392fef98519b823a3e7c056c7

  
Dropped by
SHA256 249400171cc9f0b0d659138a0a7a529bb27b01ce1b5c755e274a9cb8fab15260
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 c3f8ebc9cfb7ebe1ebbe3a4210753b271fecf73392fef98519b823a3e7c056c7
  
Dropping
MD5 b9134d2ca1cb72f262c362ba304b0d07
  
Dropped by
MD5 836e4e1f01c885b956cc7450c2b7bbd4

Comments