MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 bb402c82a60302c8a43809370bab8e233e4e29cb17181a13b2c3d57228e6c3e7. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

BazaLoader

Vendor detections: 5

Intelligence 5 IOCs YARA 2 File information Comments

SHA256 hash:	bb402c82a60302c8a43809370bab8e233e4e29cb17181a13b2c3d57228e6c3e7
SHA3-384 hash:	9465e1bf0545a1686e7c609e3f58c387fd56f4506257aea4820094e8f6c0382b7e7536db50233728b0a57f165258ed68
SHA1 hash:	00032d76df656681a3bc0b214632711e7bbb909b
MD5 hash:	19ed7a38277dc1ab308d357bff90a80f
humanhash:	edward-pip-mountain-eighteen
File name:	SecuriteInfo.com.Trojan.Malware.300983.susgen.8041
Download:	download sample
Signature	BazaLoader Create hunting rule
File size:	593'951 bytes
First seen:	2020-08-25 23:18:58 UTC
Last seen:	Never
File type:	exe
MIME type:	application/x-dosexec
imphash	d68a7f00713f10a63b1c459a67eeae6e (16 x BazaLoader)
ssdeep	6144:OJu7yDrEe9+FHM1sYr0JrU4ev9ZOh2At15jUR2EOjvktrYMZBxQTSAfGKEw:OJvD/Ys1l0JfW9H8C25jvMDZBxQ
Threatray	126 similar samples on MalwareBazaar
TLSH	43C49D52F7E449F5D073913ECAA3878AEA72B858473047CB025497192F3B7E19A3E721
Reporter	SecuriteInfoCom
Tags:	BazaLoader

Intelligence

File Origin

# of uploads :

# of downloads :

Origin country :

n/a

Vendor Threat Intelligence

Detection:

n/a

Link:

https://www.capesandbox.com/analysis/50786/

Detection(s):

PUA.Win.Downloader.Aiis-6803892-0

Result

Verdict:

Clean

Maliciousness:

Behaviour

Creating a window

Sending a UDP request

Transferring files using the Background Intelligent Transfer Service (BITS)

DNS request

Sending a custom TCP request

Launching the default Windows debugger (dwwin.exe)

Result

Threat name:

Unknown

Detection:

malicious

Classification:

spyw

Score:

68 / 100

Link:

https://www.joesandbox.com/analysis/450468

Signature

Antivirus / Scanner detection for submitted sample

Multi AV Scanner detection for submitted file

Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)

Yara detected Keylogger Generic

Behaviour

Behavior Graph:

Download SVG

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/bb402c82a60302c8a43809370bab8e233e4e29cb17181a13b2c3d57228e6c3e7/

Threat name:

Win64.Trojan.TrickBot

Status:

Malicious

First seen:

2020-08-25 23:20:24 UTC

AV detection:

20 of 29 (68.97%)

Threat level:

5/5

Verdict:

malicious

BazaLoader

3db0ffdac23433607c69a18ed4a3371a4b174672ca5d6424f7b50efa6f29d969

BazaLoader

7a3efb5cb22ae7f3b8dcd03ab2da67288034b22729af4b1e3b23c2c9454d7636

BazaLoader

86cebe269c6969250ee0b71d4a510cd7b7a34edad41bfb616504a5ecfff751ef

BazaLoader

8c671a4dec5556b8afc0841320b404d422067c4b034f563f5af29ff5837cf570

BazaLoader

93efb12bbed83f964130d8e1434ff3ba789a7c506693bcac9194fe09b35aeccf

BazaLoader

aa1be103378c35cac611142349b9d6d81eced0713cd7cba343fa93648494102e

BazaLoader

b49cea65793b29d1e91ec0ee85e5cc654682b4f974eef57063543ac20f1a5c81

BazaLoader

f3a238c27030d8a14168beb15009f192a33e89010197220561d9e68376ce5d0c

BazaLoader

ff7dae4538d435d3081fdd58eee582c1194bea7d22b96d781086689b8e21a9f9

BazaLoader

+ 116 additional samples on MalwareBazaar

Result

Malware family:

n/a

Score:

10/10

Tags:

n/a

Link:

https://tria.ge/reports/200825-dwj3fkdc1n/

Behaviour

Suspicious use of SetWindowsHookEx

Suspicious use of WriteProcessMemory

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Suspicious use of SetWindowsHookEx

Suspicious use of WriteProcessMemory

Program crash

Suspicious use of SetThreadContext

Blacklisted process makes network request

Suspicious use of NtCreateProcessExOtherParentProcess

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Trojan

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/bb402c82a60302c8a43809370bab8e233e4e29cb17181a13b2c3d57228e6c3e7

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	Cobalt_functions Create hunting rule
Author:	@j0sm1
Description:	Detect functions coded with ROR edi,D; Detect CobaltStrike used by differents groups APT

Rule name:	win_uroburos_auto Create hunting rule
Author:	Felix Bilstein - yara-signator at cocacoding dot com
Description:	autogenerated rule brought to you by yara-signator