MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 ce4b691637ed4be850404802326effa438b306d7af5538c12d6627fad9d26ab3. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

BazaLoader

Vendor detections: 8

Intelligence 8 IOCs YARA 1 File information Comments

SHA256 hash:	ce4b691637ed4be850404802326effa438b306d7af5538c12d6627fad9d26ab3
SHA3-384 hash:	d5f131c29995de01cc42d90d71994fc3d79879dd29f7e40845a772bdca4180543cb4ee323b8a982e3d9f54d76301a7d2
SHA1 hash:	7992ff5fa99a123690a97e0d645d231c0e2c23bf
MD5 hash:	240bf9b477fe3d977acbb2726f0f12b5
humanhash:	march-high-happy-fillet
File name:	Report10-9
Download:	download sample
Signature	BazaLoader Create hunting rule
File size:	401'096 bytes
First seen:	2020-10-09 18:57:09 UTC
Last seen:	2020-10-11 05:13:41 UTC
File type:	exe
MIME type:	application/x-dosexec
imphash	5f2118619fa43e0943a746ee6855b9c1 (7 x BazaLoader)
ssdeep	6144:fCW/9omGilASpsdf5+Fcxt/Zz+LbMznFo7Wo1:6WSilAjR+Fcj/U/MznO7
Threatray	152 similar samples on MalwareBazaar
TLSH	DB846B83F15530DCF4EF823BB9E64E25B6F27C520A425A0612713F65BF322905F98B69
Reporter	Anonymous
Tags:	BazaLoader exe Infinite Programming Limited

Code Signing Certificate

Organisation:	DigiCert High Assurance EV Root CA
Issuer:	DigiCert High Assurance EV Root CA
Algorithm:	sha1WithRSAEncryption
Valid from:	Nov 10 00:00:00 2006 GMT
Valid to:	Nov 10 00:00:00 2031 GMT
Serial number:	02AC5C266A0B409B8F0B79F2AE462577
Intelligence:	204 malware samples on MalwareBazaar are signed with this code signing certificate
Thumbprint Algorithm:	SHA256
Thumbprint:	7431E5F4C3C1CE4690774F0B61E05440883BA9A01ED00BA6ABD7806ED3B118CF
Source:	This information was brought to you by ReversingLabs A1000 Malware Analysis Platform

Intelligence

File Origin

# of uploads :

# of downloads :

143

Origin country :

n/a

Vendor Threat Intelligence

Detection:

n/a

Link:

https://www.capesandbox.com/analysis/69624/

Result

Verdict:

Malware

Maliciousness:

Behaviour

Sending a UDP request

DNS request

Sending a custom TCP request

Launching cmd.exe command interpreter

Unauthorized injection to a system process

Result

Threat name:

Unknown

Detection:

malicious

Classification:

spyw.evad

Score:

68 / 100

Link:

https://www.joesandbox.com/analysis/487110

Signature

Allocates memory in foreign processes

Hijacks the control flow in another process

Injects a PE file into a foreign processes

Modifies the context of a thread in another process (thread injection)

Sample uses process hollowing technique

Writes to foreign memory regions

Yara detected Keylogger Generic

Behaviour

Behavior Graph:

Download SVG

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/ce4b691637ed4be850404802326effa438b306d7af5538c12d6627fad9d26ab3/

Threat name:

Win64.Trojan.Bazaloader

Status:

Malicious

First seen:

2020-10-09 18:59:05 UTC

File Type:

PE+ (Exe)

Extracted files:

AV detection:

24 of 29 (82.76%)

Threat level:

5/5

Detection(s):

Malicious file

Link:

https://check.spamhaus.org/check/?searchterm=zzfwsfrx5vf6qucajabde3x7uq4lgbwxv5ktrqjnmyt7vwosnkzq._file

Verdict:

malicious

BazaLoader

071a87110c15bb64af2e6d976ed4da8429c3fee4c8872b82475746ea0b26351f

BazaLoader

0c7321df1373224ef65e22c96b011e1b82306a01b7834e2f80eacb9a56921ab2

BazaLoader

1055df2f38b4f540a99c23ecab450a4dc032c71579f41dd8314e892b3db21cfe

BazaLoader

34b416c0bc4803657acb69ad241de0e3a8b9c2d70769d57f8d041cc697a764c3

BazaLoader

45f8ed5faa1a4dcdc384516976190f836ce3e7b9a4ba3ff7dd0116a1ea8e121b

BazaLoader

7bffdca84095758005b4e272cb55bf0c5bdd1057ac98b0b1389af6fe3dbd7549

BazaLoader

88580df1dfe2a7ea38a971bb53463d96bccc5d3948a02a4bb38fb8b22e218890

BazaLoader

8c55e3b7ce984976b237f03414886e8a2df5884d6f1485716493c84b0abf073e

BazaLoader

bdb79a86068a90e1271cb869264f2d8f61121e0f29233cfa997aaafebae40143

BazaLoader

+ 142 additional samples on MalwareBazaar

Result

Malware family:

bazarbackdoor

Score:

10/10

Tags:

backdoor family:bazarbackdoor

Link:

https://tria.ge/reports/201009-dqxx8p38va/

Behaviour

Modifies system certificate store

Suspicious use of WriteProcessMemory

Suspicious use of SetThreadContext

Blacklisted process makes network request

BazarBackdoor

Unpacked files

SH256 hash:

ce4b691637ed4be850404802326effa438b306d7af5538c12d6627fad9d26ab3

MD5 hash:

240bf9b477fe3d977acbb2726f0f12b5

SHA1 hash:

7992ff5fa99a123690a97e0d645d231c0e2c23bf

Link:

https://www.unpac.me/results/158ffb48-f290-4e47-85cf-a5ed4c53f68a/

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Trojan

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/ce4b691637ed4be850404802326effa438b306d7af5538c12d6627fad9d26ab3

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	Cobalt_functions Create hunting rule
Author:	@j0sm1
Description:	Detect functions coded with ROR edi,D; Detect CobaltStrike used by differents groups APT