MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 d6952e516964bb1e9e333a0decbcde399c8863569a950feb4c825b41b2f7a3e9. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


BazaLoader


Vendor detections: 7


Intelligence 7 IOCs YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: d6952e516964bb1e9e333a0decbcde399c8863569a950feb4c825b41b2f7a3e9
SHA3-384 hash: b79a78e23d511f7fa537363a6ec22246d3f84e505b0b842c01a66b74ac302a7ab2ea36590ebc98c0571e2781b7ab7b95
SHA1 hash: 6da9f99941f18b926da74df160ab47f37545443b
MD5 hash: 10ff01cce645f7e2e878008c52b574bf
humanhash: mountain-crazy-skylark-tennessee
File name:Document_Print.bin
Download: download sample
Signature BazaLoader
Create hunting rule
File size:859'320 bytes
First seen:2020-10-01 15:37:43 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash 5c79a8b2cca0eda8d189d5c120988458 (2 x BazaLoader)
ssdeep 6144:k37y/+GUkEeDKUAiOCpXhQIprPjNkR7nb4e9XWeilodBU1MaB1irUIT:+m+GUneJOeXOIb+4qilodS1MVIIT
Threatray 23 similar samples on MalwareBazaar
TLSH 3405C371BAF1FEBAD512413268667E7053F29C04EEA0792AE98CF5E41531EF42F42607
Reporter Arkbird_SOLG
Tags:BazaLoader Loader


Avatar
ArkbirdDevil
Dropped from : https://docs.google.com/document/d/e/2PACX-1vRO8I4g2mTssmVUfSMOHvHaMo0xGhMXGOnxgsbBmW05T0H3D51gnteLn2L0BjUj6QttNO7sa4DVoUqn/pub
Thanks to @James_inthe_box

Intelligence

File Origin
# of uploads :
1
# of downloads :
112
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/67462/
Detection(s):
SecuriteInfo.com.generic.ml.20630.UNOFFICIAL
Create hunting rule

Result
Verdict:
Clean
Maliciousness:

Behaviour
Creating a window
Sending a UDP request
Result
Threat name:
Bazar
Create hunting rule
Detection:
malicious
Classification:
troj.evad
Score:
80 / 100
Link:
https://www.joesandbox.com/analysis/479514
Signature
Allocates memory in foreign processes
Icon mismatch, binary includes an icon from a different legit application in order to fool users
Initial sample is a PE file and has a suspicious name
Injects a PE file into a foreign processes
Modifies the context of a thread in another process (thread injection)
Sets debug register (to hijack the execution of another thread)
Writes to foreign memory regions
Yara detected Bazar Backdoor
Behaviour
Behavior Graph:
Download SVG
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/d6952e516964bb1e9e333a0decbcde399c8863569a950feb4c825b41b2f7a3e9/
Threat name:
Win64.Trojan.Bazaloader
Create hunting rule
Status:
Malicious
First seen:
2020-10-01 15:39:05 UTC
AV detection:
23 of 28 (82.14%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=22ks4uljms5r5hrthig6zpg6hgoiqy2wtkkq722mqjnudmxxupuq._file
Verdict:
malicious
Similar samples:
07011ce887b86265f51a8a7b4f5f752a8e9093b6c463e5a97ccb83bdf34764f5
BazaLoader
18fe9ceab0a17ddc71f7b7a206c1c127d62a0a86c62573b8c018ab562da1fd6e
BazaLoader
1cd3e261617e270aabe08081b0206dd857c6224631d94f36f50512628ca9ac6c
BazaLoader
7853a7780ad43f72a514ed0ad5a1f8f53f9d3470bbdb396a243091017002d84a
BazaLoader
7b86d02140dd6e4b537d1ca6a7a7ec8df70caaece6db092b13da58633f055f9d
BazaLoader
85ef348d39610c1d5f58e2524c0e929ec815a9fbe1f5924cdef7a0c05e58e5ad
BazaLoader
aed1b701e22a2c00b04020372f1fd2d534f4d097c35aedd618934804cd5b9795
BazaLoader
c4b6c04d78fe585b303ae52244e2c9a701a7f25ce328192a1c42a39425ea4c24
BazaLoader
c6964b25bb2cb50f34145266c6143c96c530690274270058551e67ab5676e9b6
BazaLoader
f895652916dd67be2dd3f14e92ee3795a6ff3888a6b255eee0a9554350d6726a
BazaLoader
+ 13 additional samples on MalwareBazaar
Result
Malware family:
bazarloader
Create hunting rule
Score:
  10/10
Tags:
loader dropper family:bazarloader
Link:
https://tria.ge/reports/201001-9yw5exfj7j/
Behaviour
Modifies system certificate store
Suspicious behavior: EnumeratesProcesses
Suspicious use of WriteProcessMemory
Suspicious use of SetThreadContext
Bazar Loader
Unpacked files
SH256 hash:
d6952e516964bb1e9e333a0decbcde399c8863569a950feb4c825b41b2f7a3e9
MD5 hash:
10ff01cce645f7e2e878008c52b574bf
SHA1 hash:
6da9f99941f18b926da74df160ab47f37545443b
Link:
https://www.unpac.me/results/5dc1e413-0dd9-4596-b2fc-f653cd42da82/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Trojan
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/d6952e516964bb1e9e333a0decbcde399c8863569a950feb4c825b41b2f7a3e9

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:Cobalt_functions
Create hunting rule
Author:@j0sm1
Description:Detect functions coded with ROR edi,D; Detect CobaltStrike used by differents groups APT

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

BazaLoader

Executable exe d6952e516964bb1e9e333a0decbcde399c8863569a950feb4c825b41b2f7a3e9

(this sample)

anyrun
any.run
https://app.any.run/tasks/929dbae1-b5f7-456c-b56f-64c32820d102
  
Delivery method
Distributed via web download
Cape
Cape
https://www.capesandbox.com/analysis/67462/

Comments