MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 c0a087a520fdfb5f1e235618b3a5101969c1de85b498bc4670372c02756efd55. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


BazaLoader


Vendor detections: 8


Intelligence 8 IOCs YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: c0a087a520fdfb5f1e235618b3a5101969c1de85b498bc4670372c02756efd55
SHA3-384 hash: 51c17fda28b638952212d3a4cc23cdc429cf3f21d4dadec025317c764709ff7f2b0d3bac55a14922e4080e55f96d32e8
SHA1 hash: e01c814d6a4993c74a2bfb87b1b661fe78c41291
MD5 hash: 63784053ac2f608d94c18b17c46ab5d4
humanhash: eight-juliet-charlie-ten
File name:1_001A060D.bin
Download: download sample
Signature BazaLoader
Create hunting rule
File size:100'864 bytes
First seen:2021-01-23 13:45:35 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash 2d10f213308ed229b8247cfc0f9da99c (1 x BazaLoader)
ssdeep 1536:WLcN7hD6tcbOLowTKEigLDQh4fHSQHNQC4y82MT89mytezfPUv:0tfspn2D/S2W68wmMeI
Threatray 27 similar samples on MalwareBazaar
TLSH 80A33B15B2D843B5F8A586B533DE46A5F4FB336A027CBF3742A0D5262214E202E8F71D
Reporter johannes
Tags:BazaLoader BazarLoader

Intelligence

File Origin
# of uploads :
1
# of downloads :
413
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
1_001A060D.bin
Verdict:
No threats detected
Analysis date:
2021-01-23 13:47:29 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/601583fd-f717-4885-8bdc-8a8c61469774

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/113626/
Detection(s):
Win.Malware.Razy-9779236-0
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Sending a UDP request
DNS request
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Result
Threat name:
Bazar Loader
Create hunting rule
Detection:
malicious
Classification:
troj.spyw
Score:
68 / 100
Link:
https://www.joesandbox.com/analysis/588866
Signature
Detected Bazar Loader
Multi AV Scanner detection for submitted file
Tries to resolve many domain names, but no domain seems valid
Yara detected Bazar Loader
Behaviour
Behavior Graph:
Download SVG
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/c0a087a520fdfb5f1e235618b3a5101969c1de85b498bc4670372c02756efd55/
Threat name:
Win64.Trojan.TrickBot
Create hunting rule
Status:
Malicious
First seen:
2021-01-23 13:46:06 UTC
AV detection:
16 of 29 (55.17%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=ycqipjja7x5v6hrdkymlhjiqdfu4dxufwsmlyrtqg4wae5lo7vkq._file
Verdict:
malicious
Similar samples:
1642ec3f8d77278e1fca7e99fb3da2ada567b0186af8c1e5dcce9b2151626434
BazaLoader
563463b7b68cb19bba718bd6d1e8e3573b7c08fbbce9d86219ea242790ee41b9
BazaLoader
5e9ba87c848255e2291680e16843305d2b797b375a3729d9f920c1b1b9781005
BazaLoader
6b24ebfb84665cb844410ec9f948cfcf7f6d08f4ede16d52930c53236390848f
BazaLoader
8d84a168fde968b3beb835a96fc340d2b4c1307e97ab677002197ed664f9838e
BazaLoader
8e244f1a5b4653d6dbb4cc3978c7dd773b227a443361fbc30265b79f102f7eed
BazaLoader
d39c5c69570369aba1312477175e799f5a921779b2eb52a85957e5ae47304165
BazaLoader
d41c191058675d5e5280c63aaa04e8eee80401d6887205c47f26723e1de9decb
BazaLoader
e3f87e59fd8941eb351fda58d6dc02de81968955491239b8e1ca1ad8e05db0ad
BazaLoader
f29253139dab900b763ef436931213387dc92e860b9d3abb7dcd46040ac28a0e
BazaLoader
+ 17 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  8/10
Tags:
n/a
Link:
https://tria.ge/reports/210123-hb9pjxm2nx/
Behaviour
Suspicious behavior: EnumeratesProcesses
Blocklisted process makes network request
Unpacked files
SH256 hash:
c0a087a520fdfb5f1e235618b3a5101969c1de85b498bc4670372c02756efd55
MD5 hash:
63784053ac2f608d94c18b17c46ab5d4
SHA1 hash:
e01c814d6a4993c74a2bfb87b1b661fe78c41291
Detections:
win_bazarbackdoor_auto
Create hunting rule
Link:
https://www.unpac.me/results/207904d8-bcb9-444e-bd1f-47268d47785f/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Suspicious File
Score:
0.42
Link:
https://yomi.yoroi.company/submissions/c0a087a520fdfb5f1e235618b3a5101969c1de85b498bc4670372c02756efd55

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:win_bazarbackdoor_auto
Create hunting rule
Author:Felix Bilstein - yara-signator at cocacoding dot com
Description:autogenerated rule brought to you by yara-signator

File information

The table below shows additional information about this malware sample such as delivery method and external references.

BazaLoader

Executable exe c0a087a520fdfb5f1e235618b3a5101969c1de85b498bc4670372c02756efd55

(this sample)

BazaLoader

Executable exe 8e244f1a5b4653d6dbb4cc3978c7dd773b227a443361fbc30265b79f102f7eed

Malpedia
Malpedia
https://malpedia.caad.fkie.fraunhofer.de/details/win.bazarbackdoor
  
Dropping
SHA256 8e244f1a5b4653d6dbb4cc3978c7dd773b227a443361fbc30265b79f102f7eed
Cape
Cape
https://www.capesandbox.com/analysis/113626/

Comments