MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 c1cc9ec32368165e6625b2e2623ac0c3ca69bfa63a5b11e82a09bf18f6bd6410. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


BazaLoader


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: c1cc9ec32368165e6625b2e2623ac0c3ca69bfa63a5b11e82a09bf18f6bd6410
SHA3-384 hash: f019bc665319de4742df5ca775c17317ca9cfe9ab9b2c1bf6bcf10424a1bd537c301d67f3997b28296c5dd222fc4d8d1
SHA1 hash: 463bd591c44b647f1b730672f881774e8467edbe
MD5 hash: 69c5720386ad26350c9ef666a57cb2f0
humanhash: georgia-fix-carpet-robin
File name:Stolen Images Evidence.zip
Download: download sample
Signature BazaLoader
Create hunting rule
File size:4'763 bytes
First seen:2021-09-07 23:34:10 UTC
Last seen:2021-09-07 23:34:27 UTC
File type: zip
MIME type:application/zip
ssdeep 96:bZhlGK/GbHAqivqe8PwLjgr5FKBDgdiwvY6yIfPruuDtBoc:oKubgqikPwLjgjyDgnvY7Iui7/
TLSH T151A17E959A5D0D02BA84E2BF1F46E325928A04859BF5CAA141FE024ACE55B043B39730
Reporter malware_traffic
Tags:BazaLoader BazarLoader js zip

Intelligence

File Origin
# of uploads :
2
# of downloads :
219
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Sanesecurity.Foxhole.JS_Zip_1.UNOFFICIAL
Create hunting rule

PUA.SecuriteInfo.com.JS.Malware-1.UNOFFICIAL
Create hunting rule

Result
Verdict:
MALICIOUS
Link:
https://labs.inquest.net/dfi/sha256/c1cc9ec32368165e6625b2e2623ac0c3ca69bfa63a5b11e82a09bf18f6bd6410
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/c1cc9ec32368165e6625b2e2623ac0c3ca69bfa63a5b11e82a09bf18f6bd6410/
Result
Malware family:
n/a
Score:
  10/10
Tags:
n/a
Link:
https://tria.ge/reports/210907-3k1t7sgfbk/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Program crash
Blocklisted process makes network request
Malware Config
Dropper Extraction:
http://mabiorex.space/333g100/index.php
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/c1cc9ec32368165e6625b2e2623ac0c3ca69bfa63a5b11e82a09bf18f6bd6410

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Comments