MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 e1a9f6a0f2f0aa7a3bdc04976604fa7169b812ff4976e2f0105992fb8277a52c. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


BazaLoader


Vendor detections: 7


Intelligence 7 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: e1a9f6a0f2f0aa7a3bdc04976604fa7169b812ff4976e2f0105992fb8277a52c
SHA3-384 hash: 15b60d006de30593633a239ab146606d1ef2b23a5ce4720c47027118c6159b3ed3ca2bc00d99ab9189b28989bedab263
SHA1 hash: 188544648a1bc504253ce03c3f2e39ee34360a15
MD5 hash: 986e8dcfa33aae9ca91588560fe91d44
humanhash: social-nitrogen-bakerloo-helium
File name:yZGYbaJ.dll
Download: download sample
Signature BazaLoader
Create hunting rule
File size:813'584 bytes
First seen:2021-11-23 16:22:26 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash d53c413ff89d1ad0fd374ba2728c9047 (2 x BazaLoader)
ssdeep 6144:GMVvrmD0crjGFcdkEJ+uzx0OjtsQZjDErWdzw9nuD9YceqCCeSFuixAYhEzZRlyn:/vrmD0crjGtgtsQZAWB9WqCiFuWAmk8X
Threatray 67 similar samples on MalwareBazaar
TLSH T1F4057E7E8871051AEEDB08F89CD8BFD9E596666D1F25D4BA5C31E0F03E313B9A806113
Reporter Rony
Tags:BazaLoader BazarLoader dll exe

Intelligence

File Origin
# of uploads :
1
# of downloads :
213
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
yZGYbaJ.dll
Verdict:
No threats detected
Analysis date:
2021-11-23 16:29:27 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/0e8025dc-e3a9-43e7-916e-8c0937e0ec40

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Gathering data
Result
Verdict:
Clean
Maliciousness:

Behaviour
DNS request
Сreating synchronization primitives
Verdict:
Suspicious
Threat level:
  5/10
Confidence:
100%
Tags:
overlay packed
Link:
https://www.filescan.io/uploads/619d1569b71ceed4152d32dd/reports/554b5098-3d06-4d71-93e4-c8fcea43d126/overview
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Verdict:
Unknown
Link:
https://analyze.intezer.com/analyses/55be9af7-9009-4de1-b490-0633323decdd
Result
Threat name:
Unknown
Detection:
malicious
Classification:
evad
Score:
76 / 100
Link:
https://www.joesandbox.com/analysis/894899
Signature
Allocates memory in foreign processes
Injects a PE file into a foreign processes
Modifies the context of a thread in another process (thread injection)
Multi AV Scanner detection for submitted file
System process connects to network (likely due to code injection or exploit)
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Writes to foreign memory regions
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 527377 Sample: yZGYbaJ.dll Startdate: 23/11/2021 Architecture: WINDOWS Score: 76 34 Multi AV Scanner detection for submitted file 2->34 36 Tries to detect sandboxes and other dynamic analysis tools (process name or module or function) 2->36 7 loaddll64.exe 1 2->7         started        process3 process4 9 regsvr32.exe 13 7->9         started        13 iexplore.exe 1 73 7->13         started        15 cmd.exe 1 7->15         started        17 3 other processes 7->17 dnsIp5 32 162.33.179.96, 443, 49828 CORENETUS United States 9->32 38 System process connects to network (likely due to code injection or exploit) 9->38 40 Writes to foreign memory regions 9->40 42 Allocates memory in foreign processes 9->42 44 2 other signatures 9->44 19 chrome.exe 9->19         started        21 iexplore.exe 2 146 13->21         started        24 rundll32.exe 15->24         started        signatures6 process7 dnsIp8 26 btloader.com 104.26.7.139, 443, 49818, 49819 CLOUDFLARENETUS United States 21->26 28 www.msn.com 21->28 30 7 other IPs or domains 21->30
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/e1a9f6a0f2f0aa7a3bdc04976604fa7169b812ff4976e2f0105992fb8277a52c/
Threat name:
Win64.Spyware.Bazarloader
Create hunting rule
Status:
Malicious
First seen:
2021-11-19 03:18:08 UTC
File Type:
PE+ (Dll)
Extracted files:
1
AV detection:
16 of 27 (59.26%)
Threat level:
  2/5
Verdict:
malicious
Similar samples:
02c8c4d08cdd2bc230e6ed2676d20867eb4fb733bf254432ac6d339d7406b8f9
BazaLoader
03212850d80dd26f4b6706024516f1834e7b8ae9fc31231b2a624106242c4838
BazaLoader
14cc39c7804ff5f599fc801d763a7973f5a99a0d510327a86b1b3f0f25a8fe49
BazaLoader
46e596461f8ee1fd4d63bd1a2e7366a938e06f19750cfc90a9609edbce7381a1
BazaLoader
485a3c191731de674005bf28bb644672cfcc1bad58abb9b7d0f36d71d2973067
BazaLoader
8f373e1671d5073d0760f1480c561f3e29da7a83fc91f6950ee9e7a80e0dfe52
BazaLoader
d1c628414464ca89e07404650c490ca1e3dfab596b4ec603e3811d37f48bbf7c
BazaLoader
+ 57 additional samples on MalwareBazaar
Result
Malware family:
bazarloader
Create hunting rule
Score:
  10/10
Tags:
family:bazarloader dropper loader
Link:
https://tria.ge/reports/211123-tvs3nsaffl/
Behaviour
Bazar/Team9 Loader payload
Bazar Loader
Unpacked files
SH256 hash:
e1a9f6a0f2f0aa7a3bdc04976604fa7169b812ff4976e2f0105992fb8277a52c
MD5 hash:
986e8dcfa33aae9ca91588560fe91d44
SHA1 hash:
188544648a1bc504253ce03c3f2e39ee34360a15
Link:
https://www.unpac.me/results/efe411ed-b367-4652-b064-dad750290039/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Suspicious File
Score:
0.34
Link:
https://yomi.yoroi.company/submissions/e1a9f6a0f2f0aa7a3bdc04976604fa7169b812ff4976e2f0105992fb8277a52c

File information

The table below shows additional information about this malware sample such as delivery method and external references.

  
Dropping
BazarBackdoor
Cape
Cape
https://www.capesandbox.com/analysis/208768/

Comments