MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 f0548ac778c8bcea06c577a13e7b0856b73838715c2fab1b1e83096e2333f82f. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

BazarCall

Vendor detections: 7

Intelligence 7 IOCs YARA 1 File information Comments

SHA256 hash:	f0548ac778c8bcea06c577a13e7b0856b73838715c2fab1b1e83096e2333f82f
SHA3-384 hash:	6d463ea85c0bf73052a68c76d06e72f9fa26e755880ad71c1a264326707480121515c1733488c0456871bce1ace195f0
SHA1 hash:	bc692e267de92133ecd58fc90882feb91572b62d
MD5 hash:	83e6a0bec752cfa12db166b45ba49a79
humanhash:	avocado-autumn-angel-eleven
File name:	83e6a0bec752cfa12db166b45ba49a79.exe
Download:	download sample
Signature	BazarCall Create hunting rule
File size:	285'696 bytes
First seen:	2021-03-31 07:23:20 UTC
Last seen:	2021-04-01 02:50:50 UTC
File type:	exe
MIME type:	application/x-dosexec
ssdeep	6144:11jPZmG29u87HxpEyp2SNj91keVmvOC/OXcG26EqKXfV2ldUJR94VcTAgmQ:nZdMRp70SNj91ke4Om1YVld8T4VA
Threatray	18 similar samples on MalwareBazaar
TLSH	EC54BFB876146CE6E66F927BDE96BCED13B236628A87D9CC806477C30563371FE01805
Reporter	abuse_ch
Tags:	BazarCall exe

Intelligence

File Origin

# of uploads :

# of downloads :

144

Origin country :

n/a

Vendor Threat Intelligence

Malware family:

n/a

ID:

File name:

83e6a0bec752cfa12db166b45ba49a79.exe

Verdict:

No threats detected

Analysis date:

2021-03-31 07:31:14 UTC

Tags:

n/a

Link:

https://app.any.run/tasks/63d05c85-d1d5-42ef-82be-0eafe213aa47

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

Detection:

n/a

Link:

https://www.capesandbox.com/analysis/129194/

Detection(s):

SecuriteInfo.com.generic.ml.2178.11136.UNOFFICIAL

Result

Verdict:

Malware

Maliciousness:

Behaviour

DNS request

Sending a UDP request

Transferring files using the Background Intelligent Transfer Service (BITS)

Sending a custom TCP request

Launching a process

Unauthorized injection to a recently created process

Unauthorized injection to a recently created process by context flags manipulation

Result

Verdict:

MALICIOUS

Details

Windows PE Executable

Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.

Result

Threat name:

Unknown

Detection:

malicious

Classification:

evad

Score:

80 / 100

Link:

https://www.joesandbox.com/analysis/659853

Signature

Allocates memory in foreign processes

Injects a PE file into a foreign processes

Modifies the context of a thread in another process (thread injection)

Multi AV Scanner detection for submitted file

Sample uses process hollowing technique

Sets debug register (to hijack the execution of another thread)

Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)

Writes to foreign memory regions

Behaviour

Behavior Graph:

Download SVG

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/f0548ac778c8bcea06c577a13e7b0856b73838715c2fab1b1e83096e2333f82f/

Threat name:

Win64.Trojan.Fuerboos

Status:

Malicious

First seen:

2021-03-30 18:52:19 UTC

AV detection:

12 of 29 (41.38%)

Threat level:

5/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=6bkivr3yzc6oubwfo6qt46yik23tqodrlqx2wgy6qmew4izt7axq._file

Verdict:

suspicious

BazarCall

2fe32b0f648bfe69c9873c7a57a62358057eab750a081f9285c11e94327c42d6

BazarCall

42edefa09a3d85a3d4284f6ef57691c8b409ac00da21c799ae14b1adf17435f0

BazarCall

540d75f2828a1eaec24e7e1eef405b850a49d3f86a3fbde661fd7c69f2528d8f

BazarCall

5edd735e3c6b81d985f3eadd1f8cae24091b947699f1152528566124f22d5341

BazarCall

74d117615930c1a51e28e7db460a6f6135eb5070f0975598267e7f07d5a170f7

BazarCall

911d3b7d0ad2b9408ca63c381a73f38b15019954d4ff6ffe3fcac8f716c2a200

BazarCall

bdbe4c345b4e7c8ae008c86bb052f015050a7d62d28c3507eaaa329d00f30572

BazarCall

c8510031a868ab8ef2b11a4261d2aba8c9be252294780faea012bfa94c6d0c70

BazarCall

d22f536d4d6cc001271855f4467af0bbc656801e1ffa34a8acd905db56cebae0

BazarCall

+ 8 additional samples on MalwareBazaar

Result

Malware family:

n/a

Score:

8/10

Tags:

n/a

Link:

https://tria.ge/reports/210331-mt9ktl5ldn/

Behaviour

Suspicious behavior: EnumeratesProcesses

Suspicious use of WriteProcessMemory

Suspicious use of SetThreadContext

Blocklisted process makes network request

Unpacked files

SH256 hash:

f0548ac778c8bcea06c577a13e7b0856b73838715c2fab1b1e83096e2333f82f

MD5 hash:

83e6a0bec752cfa12db166b45ba49a79

SHA1 hash:

bc692e267de92133ecd58fc90882feb91572b62d

Link:

https://www.unpac.me/results/2b0184d1-b8e4-45b1-94d3-d4ef209f8700/

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

REvil

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/f0548ac778c8bcea06c577a13e7b0856b73838715c2fab1b1e83096e2333f82f

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.