MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 cefdcb4e5cac9b1bb183f667b39deac6bffa0337e61e4e0a323f712f168accc6. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


BazaLoader


Vendor detections: 5


Intelligence 5 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: cefdcb4e5cac9b1bb183f667b39deac6bffa0337e61e4e0a323f712f168accc6
SHA3-384 hash: b0e877d2be2cd4dc2900721a5fe214500f1252b50fc9bb0a91508d15ab63e78ee2768411c55a3dfb39a579c4fcd06303
SHA1 hash: 76921d2259a0d5cde471cbb27fe3aaf79bf781f7
MD5 hash: 0324170260d52116b770932b0700ff26
humanhash: single-october-sodium-sierra
File name:SecuriteInfo.com.Generic.mg.0324170260d52116.31641
Download: download sample
Signature BazaLoader
Create hunting rule
File size:1'042'929 bytes
First seen:2021-02-09 22:52:57 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash b4fde864c45f66c378efc2bedd98550f (17 x BazaLoader)
ssdeep 6144:do3pwmXC25RIyX4db7SvNJnxPGpvSiyS:ddmy2X4d
Threatray 10 similar samples on MalwareBazaar
TLSH 72257B1B72E434FCE066D634C9904245EBB5743507768FAF03E886A92F536A1AD7EB30
Reporter SecuriteInfoCom
Tags:BazaLoader

Intelligence

File Origin
# of uploads :
1
# of downloads :
112
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
SecuriteInfo.com.Generic.mg.0324170260d52116.31641
Verdict:
No threats detected
Analysis date:
2021-02-09 23:11:17 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/670ecfbc-ea84-4216-b28a-9d86964c4ca7

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/116344/
Detection(s):
SecuriteInfo.com.Generic.mg.0324170260d52116.31641.UNOFFICIAL
Create hunting rule

SecuriteInfo.com.Artemis018048AA9219.28755.UNOFFICIAL
Create hunting rule

Result
Verdict:
Suspicious
Maliciousness:

Behaviour
Sending a UDP request
Running batch commands
Creating a process with a hidden window
Launching a process
Result
Verdict:
UNKNOWN
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Result
Threat name:
Unknown
Detection:
malicious
Classification:
troj.evad
Score:
80 / 100
Link:
https://www.joesandbox.com/analysis/603710
Signature
Machine Learning detection for dropped file
Machine Learning detection for sample
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)
Uses ping.exe to check the status of other devices and networks
Uses ping.exe to sleep
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 350856 Sample: SecuriteInfo.com.Generic.mg... Startdate: 09/02/2021 Architecture: WINDOWS Score: 80 63 Snort IDS alert for network traffic (e.g. based on Emerging Threat rules) 2->63 65 Multi AV Scanner detection for submitted file 2->65 67 Uses ping.exe to sleep 2->67 69 2 other signatures 2->69 11 SecuriteInfo.com.Generic.mg.0324170260d52116.exe 2->11         started        13 uaetnyaskkk.exe 2->13         started        15 uaetnyaskkk.exe 2->15         started        process3 process4 17 cmd.exe 1 11->17         started        dnsIp5 59 127.0.0.1 unknown unknown 17->59 71 Uses ping.exe to sleep 17->71 21 SecuriteInfo.com.Generic.mg.0324170260d52116.exe 3 17->21         started        24 conhost.exe 17->24         started        26 PING.EXE 1 17->26         started        signatures6 process7 file8 55 C:\Users\user\AppData\...\uaetnyaskkk.exe, PE32+ 21->55 dropped 57 C:\Users\...\uaetnyaskkk.exe:Zone.Identifier, ASCII 21->57 dropped 28 cmd.exe 1 21->28         started        31 cmd.exe 1 21->31         started        33 cmd.exe 1 21->33         started        process9 signatures10 77 Uses ping.exe to sleep 28->77 35 uaetnyaskkk.exe 28->35         started        39 conhost.exe 28->39         started        41 PING.EXE 1 28->41         started        43 conhost.exe 31->43         started        45 reg.exe 1 1 31->45         started        47 conhost.exe 33->47         started        process11 dnsIp12 61 52.37.89.225, 443, 49731, 49759 AMAZON-02US United States 35->61 73 Multi AV Scanner detection for dropped file 35->73 75 Machine Learning detection for dropped file 35->75 49 cmd.exe 1 35->49         started        signatures13 process14 process15 51 conhost.exe 49->51         started        53 reg.exe 1 49->53         started       
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/cefdcb4e5cac9b1bb183f667b39deac6bffa0337e61e4e0a323f712f168accc6/
Threat name:
Win64.Trojan.Bazarldr
Create hunting rule
Status:
Malicious
First seen:
2021-02-09 21:18:35 UTC
AV detection:
22 of 29 (75.86%)
Threat level:
  5/5
Verdict:
unknown
Similar samples:
375cb8f99ca2f56c79bf1e632ef30b4bfd20866ca47c028688bab9fa20c69320
BazaLoader
502985c35a5b440dfc18d5dc12e524726567311ebabe35cddde961acbe718cbb
BazaLoader
52b441ab29135703146fdd5d75db3b0e441c9bc187a8df4e6201a033edd0b8de
BazaLoader
5779383242bc52dd737295a5f802288cb19bb3d44a8f85c3c0a806c99d6e215d
BazaLoader
5cb9b33ca105d1f74a81fc104a8f6054c8db69f5c20091de74f877a75deceea6
BazaLoader
63b65aa8b297247365df8d10efb7e3645ccb561b74c78690db76905a584b2c26
BazaLoader
76cdb9f1dd635489d8cf6cb294fe5805c95a090c6cf00aafe1a8a397da3b1f03
BazaLoader
951d92a848709c99656328efbc427caca665727b51e455776f67fa3cbab37c94
BazaLoader
df1e5e50ded27dafde6819a5dd685c435175a14def9f1aacc1d6a7aeb5fff662
BazaLoader
e0f0d4358a6f0c5a8b64bace8756e26086eee10ae7830c864c6b500bcc31b581
BazaLoader
Result
Malware family:
n/a
Score:
  1/10
Tags:
n/a
Link:
https://tria.ge/reports/210209-ncy3aygmgx/
Behaviour
Runs ping.exe
Suspicious use of WriteProcessMemory
Unpacked files
SH256 hash:
cefdcb4e5cac9b1bb183f667b39deac6bffa0337e61e4e0a323f712f168accc6
MD5 hash:
0324170260d52116b770932b0700ff26
SHA1 hash:
76921d2259a0d5cde471cbb27fe3aaf79bf781f7
Link:
https://www.unpac.me/results/b63bee40-2bf5-47a8-b81e-1916914e7592/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/cefdcb4e5cac9b1bb183f667b39deac6bffa0337e61e4e0a323f712f168accc6

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

BazaLoader

Executable exe cefdcb4e5cac9b1bb183f667b39deac6bffa0337e61e4e0a323f712f168accc6

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/997648/
  
Delivery method
Distributed via web download
Cape
Cape
https://www.capesandbox.com/analysis/116344/

Comments