MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 f471cbd53a52d27053c33c4fd18fe2305f94f947d8cc2275c3506fe74c2f11f5. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


BazaLoader


Vendor detections: 8


Intelligence 8 IOCs YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: f471cbd53a52d27053c33c4fd18fe2305f94f947d8cc2275c3506fe74c2f11f5
SHA3-384 hash: fea444904ab0b4de60978d1909b9faf4c360758bb016cab0a1baa950cc3a878e7427855f548ba4c27da7d687598119f7
SHA1 hash: 7bbd86dd91e2a43ae6d7a132ac1918875146a40c
MD5 hash: 8c32e44ea7eadbeca921d8e292171556
humanhash: fruit-kansas-early-nineteen
File name:f471cbd53a52d27053c33c4fd18fe2305f94f947d8cc2275c3506fe74c2f11f5
Download: download sample
Signature BazaLoader
Create hunting rule
File size:12'564'200 bytes
First seen:2020-10-20 16:49:39 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash d70019f08a07eb5eb005abbcf216f569 (7 x BazaLoader)
ssdeep 196608:akYZ6ZRSJJ01qMlXkfBe0sx7BogxN44qYO2FLOyomFHKnPAWFLOyomFHKnPr:ahJNBzE4BYHFeFG
Threatray 181 similar samples on MalwareBazaar
TLSH FEC67C40AA4940ADE9B750FA4A9D652EE16DBCA0271051C781D43FFABF373D02E35A1F
Reporter JAMESWT_WT
Tags:BazaLoader NOSOV SP Z O O signed

Code Signing Certificate

Organisation:NOSOV SP Z O O
Issuer:DigiCert EV Code Signing CA
Algorithm:sha256WithRSAEncryption
Valid from:Aug 21 00:00:00 2020 GMT
Valid to:Aug 18 12:00:00 2021 GMT
Serial number: 0BAB6A2AA84B495D9E554A4C42C0126D
Intelligence: 9 malware samples on MalwareBazaar are signed with this code signing certificate
MalwareBazaar Blocklist:This certificate is on the MalwareBazaar code signing certificate blocklist (CSCB)
Thumbprint Algorithm:SHA256
Thumbprint: E6FA7B4756B41B8EC049237B96A8C1DF2ADA4582E440A63D8FC3B0787C3EFEB8
Source:This information was brought to you by ReversingLabs A1000 Malware Analysis Platform

Intelligence

File Origin
# of uploads :
1
# of downloads :
108
Origin country :
n/a
Vendor Threat Intelligence
Detection:
BazaLoader
Create hunting rule
Link:
https://www.capesandbox.com/analysis/73595/
Result
Verdict:
Malware
Maliciousness:

Behaviour
Sending a UDP request
Transferring files using the Background Intelligent Transfer Service (BITS)
DNS request
Launching cmd.exe command interpreter
Sending a TCP request to an infection source
Unauthorized injection to a system process
Result
Threat name:
Unknown
Detection:
suspicious
Classification:
n/a
Score:
29 / 100
Link:
https://www.joesandbox.com/analysis/498556
Signature
A
c
e
f
g
i
l
m
n
o
p
r
s
t
y
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 process2 2 Behavior Graph ID: 301268 Sample: 9Tzpbzt7Im.exe Startdate: 20/10/2020 Architecture: WINDOWS Score: 29 5 9Tzpbzt7Im.exe 38 2->5         started        9 9Tzpbzt7Im.exe 20 2->9         started        11 9Tzpbzt7Im.exe 20 2->11         started        dnsIp3 17 dghns.xyz 34.222.33.48, 443, 49710, 49711 AMAZON-02US United States 5->17 19 Allocates memory in foreign processes 5->19 13 WerFault.exe 20 9 5->13         started        15 cmd.exe 5->15         started        signatures4 process5
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/f471cbd53a52d27053c33c4fd18fe2305f94f947d8cc2275c3506fe74c2f11f5/
Threat name:
Win64.Trojan.Bazaloader
Create hunting rule
Status:
Malicious
First seen:
2020-10-20 16:47:29 UTC
File Type:
PE+ (Exe)
Extracted files:
1671
AV detection:
22 of 28 (78.57%)
Threat level:
  5/5
Verdict:
malicious
Similar samples:
071a87110c15bb64af2e6d976ed4da8429c3fee4c8872b82475746ea0b26351f
BazaLoader
0d468fc1b02bbc7c3050c67e0a80b580c69abd8eea5f8dad06c7d7ff396f7789
BazaLoader
34b416c0bc4803657acb69ad241de0e3a8b9c2d70769d57f8d041cc697a764c3
BazaLoader
665fdcff6c010772cfa701050b2bc5c7b008a0e8a73fa3c59e1dde546b78003b
BazaLoader
690ff4ee36a9ee03248ce8e45a605e718eb48778ffbce1b48f9a5522175ba611
BazaLoader
86e4be488d98cb086d8161baa7b58c28ab2ce2d0e415ff1d29d0f537bb16c773
BazaLoader
88580df1dfe2a7ea38a971bb53463d96bccc5d3948a02a4bb38fb8b22e218890
BazaLoader
9e2f9dbbe77ad22963dd6456dc30b807a2e6482c01a232498e75ecb84a8a582e
BazaLoader
c1a8d92dd4d6a2e51be9be6957c6d0398bef80a667c879c365c622033ea7a8a5
BazaLoader
d3f27f0ba1900e461e292bf8f62028b60cac902ef71cbe455115d008c0ed27c6
BazaLoader
+ 171 additional samples on MalwareBazaar
Result
Malware family:
bazarbackdoor
Create hunting rule
Score:
  10/10
Tags:
backdoor family:bazarbackdoor
Link:
https://tria.ge/reports/201020-zlbk5rmzga/
Behaviour
Modifies system certificate store
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
Suspicious use of SetThreadContext
Blacklisted process makes network request
BazarBackdoor
Unpacked files
SH256 hash:
f471cbd53a52d27053c33c4fd18fe2305f94f947d8cc2275c3506fe74c2f11f5
MD5 hash:
8c32e44ea7eadbeca921d8e292171556
SHA1 hash:
7bbd86dd91e2a43ae6d7a132ac1918875146a40c
Link:
https://www.unpac.me/results/219c145e-453e-48ae-bbe2-6bfde638e8ff/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Trojan
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/f471cbd53a52d27053c33c4fd18fe2305f94f947d8cc2275c3506fe74c2f11f5

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:Cobalt_functions
Create hunting rule
Author:@j0sm1
Description:Detect functions coded with ROR edi,D; Detect CobaltStrike used by differents groups APT

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/73595/

Comments