MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 e0f0d4358a6f0c5a8b64bace8756e26086eee10ae7830c864c6b500bcc31b581. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


BazaLoader


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: e0f0d4358a6f0c5a8b64bace8756e26086eee10ae7830c864c6b500bcc31b581
SHA3-384 hash: 07fe1469175a5209b759f1e5e8cd47fa47977dda0fa53a373e3fe953111611b6374bcbfb54fd10d2de0b066a6bb05232
SHA1 hash: 5c1b3925a3a6fb6566ed4f8f3086f86f055aa64b
MD5 hash: 213e13e37a770a541d031f51efddd988
humanhash: fanta-six-july-quebec
File name:SecuriteInfo.com.Generic.mg.213e13e37a770a54.5743
Download: download sample
Signature BazaLoader
Create hunting rule
File size:1'043'073 bytes
First seen:2021-02-09 22:52:22 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash b4fde864c45f66c378efc2bedd98550f (17 x BazaLoader)
ssdeep 6144:do3pwmXC25RIyX4db7SvNJnxPGpvSiyS:ddmy2X4d
Threatray 4 similar samples on MalwareBazaar
TLSH F4257B1B72E434FCE066D634C9904245EBB5743507768FAF03E886A92F536A1AD7EB30
Reporter SecuriteInfoCom
Tags:BazaLoader

Intelligence

File Origin
# of uploads :
1
# of downloads :
111
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
SecuriteInfo.com.Generic.mg.213e13e37a770a54.5743
Verdict:
No threats detected
Analysis date:
2021-02-09 22:53:51 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/8afa5fd3-99df-43ae-983a-e7db8a7366fc

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/116321/
Detection(s):
SecuriteInfo.com.Generic.mg.213e13e37a770a54.5743.UNOFFICIAL
Create hunting rule

SecuriteInfo.com.Artemis018048AA9219.28755.UNOFFICIAL
Create hunting rule

Result
Verdict:
Clean
Maliciousness:

Behaviour
Sending a UDP request
Result
Verdict:
UNKNOWN
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Result
Threat name:
Unknown
Detection:
malicious
Classification:
troj.evad
Score:
80 / 100
Link:
https://www.joesandbox.com/analysis/603761
Signature
Machine Learning detection for dropped file
Machine Learning detection for sample
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)
Uses ping.exe to check the status of other devices and networks
Uses ping.exe to sleep
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 350881 Sample: SecuriteInfo.com.Generic.mg... Startdate: 10/02/2021 Architecture: WINDOWS Score: 80 63 Snort IDS alert for network traffic (e.g. based on Emerging Threat rules) 2->63 65 Multi AV Scanner detection for submitted file 2->65 67 Uses ping.exe to sleep 2->67 69 2 other signatures 2->69 11 SecuriteInfo.com.Generic.mg.213e13e37a770a54.exe 2->11         started        13 pxbifjcyn.exe 2->13         started        15 pxbifjcyn.exe 2->15         started        process3 process4 17 cmd.exe 1 11->17         started        dnsIp5 59 127.0.0.1 unknown unknown 17->59 71 Uses ping.exe to sleep 17->71 21 SecuriteInfo.com.Generic.mg.213e13e37a770a54.exe 3 17->21         started        24 conhost.exe 17->24         started        26 PING.EXE 1 17->26         started        signatures6 process7 file8 55 C:\Users\user\AppData\Local\...\pxbifjcyn.exe, PE32+ 21->55 dropped 57 C:\Users\...\pxbifjcyn.exe:Zone.Identifier, ASCII 21->57 dropped 28 cmd.exe 1 21->28         started        31 cmd.exe 1 21->31         started        33 cmd.exe 1 21->33         started        process9 signatures10 77 Uses ping.exe to sleep 28->77 35 pxbifjcyn.exe 28->35         started        39 conhost.exe 28->39         started        41 PING.EXE 1 28->41         started        43 conhost.exe 31->43         started        45 reg.exe 1 1 31->45         started        47 conhost.exe 33->47         started        process11 dnsIp12 61 52.37.89.225, 443, 49722, 49736 AMAZON-02US United States 35->61 73 Multi AV Scanner detection for dropped file 35->73 75 Machine Learning detection for dropped file 35->75 49 cmd.exe 1 35->49         started        signatures13 process14 process15 51 conhost.exe 49->51         started        53 reg.exe 1 49->53         started       
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/e0f0d4358a6f0c5a8b64bace8756e26086eee10ae7830c864c6b500bcc31b581/
Threat name:
Win64.Trojan.Ymacco
Create hunting rule
Status:
Malicious
First seen:
2021-02-09 21:32:08 UTC
AV detection:
17 of 29 (58.62%)
Threat level:
  5/5
Verdict:
unknown
Similar samples:
502985c35a5b440dfc18d5dc12e524726567311ebabe35cddde961acbe718cbb
BazaLoader
5779383242bc52dd737295a5f802288cb19bb3d44a8f85c3c0a806c99d6e215d
BazaLoader
76cdb9f1dd635489d8cf6cb294fe5805c95a090c6cf00aafe1a8a397da3b1f03
BazaLoader
cefdcb4e5cac9b1bb183f667b39deac6bffa0337e61e4e0a323f712f168accc6
BazaLoader
Result
Malware family:
n/a
Score:
  1/10
Tags:
n/a
Link:
https://tria.ge/reports/210209-cx9zrl4ne6/
Behaviour
Runs ping.exe
Suspicious use of WriteProcessMemory
Unpacked files
SH256 hash:
e0f0d4358a6f0c5a8b64bace8756e26086eee10ae7830c864c6b500bcc31b581
MD5 hash:
213e13e37a770a541d031f51efddd988
SHA1 hash:
5c1b3925a3a6fb6566ed4f8f3086f86f055aa64b
Link:
https://www.unpac.me/results/e8637a9d-2bfb-4ff1-bc6e-babcfe11e7c7/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/e0f0d4358a6f0c5a8b64bace8756e26086eee10ae7830c864c6b500bcc31b581

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

BazaLoader

Executable exe e0f0d4358a6f0c5a8b64bace8756e26086eee10ae7830c864c6b500bcc31b581

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/997638/
  
Delivery method
Distributed via web download
Cape
Cape
https://www.capesandbox.com/analysis/116321/

Comments