bazaloader | svchost_dump_SCY - Copy[.]bin[.]zip

Resubmissions

23/01/2024, 14:03

240123-rcwpqsbff310

23/01/2024, 13:44

240123-q13yaabef710

Sharing

Copy URL Twitter E-mail

General

Target
svchost_dump_SCY - Copy.bin.zip
Size 2.4MB
Sample240123-q13yaabef7
SHA256 f04d11a1c4811492e397bc151c65ea1958eab6cbcf279ece7bd59160bfbea3d8
MD5 1a2f128d6c8b5873ea628daea3f14676
SHA1 1a92a3a742952b6cfa7486fc796c8d5ea133fd5f
SHA512 c365cd4224cb652d0790ac9dab846a676e10e146e25861c25941a5adbe71ed232ff9826189c250a21424b3ac12cf2a9a92e47cb870cffd31f66774d0ecca5331
SSDEEP 49152:uZm0/SR/6qlcjHAQhFF2g+X6JWj4JBhhK9bBPYtsN/hvWl6TWDwMYXECjG:uZf/SgqlcjgCFo6JW28b1IsN5vW8GMEf
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

trojan bazaloader

Malware Config

Signatures

Bazaloader family
bazaloader

Detects BazaLoader malware 1 IoCs

BazaLoader is a trojan that transmits logs to the Command and Control (C2) server, encoding them in BASE64 format through GET requests.

trojan

resource	yara_rule
static1/unpack001/svchost_dump_SCY - Copy.bin	BazaLoader

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/svchost_dump_SCY - Copy.bin

File Explorer

svchost_dump_SCY - Copy.bin.zip

.zip 2.4MB
svchost_dump_SCY - Copy.bin

.exe 5.2MB

svchost_dump_SCY - Copy.bin.zip

SHA256 f04d11a1c4811492e397bc151c65ea1958eab6cbcf279ece7bd59160bfbea3d8
MD5 1a2f128d6c8b5873ea628daea3f14676
SHA1 1a92a3a742952b6cfa7486fc796c8d5ea133fd5f
SHA512 c365cd4224cb652d0790ac9dab846a676e10e146e25861c25941a5adbe71ed232ff9826189c250a21424b3ac12cf2a9a92e47cb870cffd31f66774d0ecca5331
SSDEEP 49152:uZm0/SR/6qlcjHAQhFF2g+X6JWj4JBhhK9bBPYtsN/hvWl6TWDwMYXECjG:uZf/SgqlcjgCFo6JW28b1IsN5vW8GMEf
MD5 SHA1 SHA512 SSDEEP

Password

infected

svchost_dump_SCY - Copy.bin

IMPHASH a36c1890ad00c18dd7657e5d32beb26c
SHA256 7ac7b42889e14cbd8c7cebe692566ca045d0034f9ff103fc3ef9c5e035dc594f
MD5 5fd3d21a968f4b8a1577b5405ab1c36a
SHA1 710e5ab0fceb71b982b966c3a7406ebdf1d2aa82
SHA512 085a31c0412ba0a3d612a66ec8d95ce900e148240f92f9ec8c4d07b6c8e32cf233e92aefc7b4b53a91f5eacacd1cf3a8fcdf8cd7c206afa46014a9e4a9ddf53f
SSDEEP 98304:jgoX+R+gW1CkQFBAFGspWvuL136BRiGQiiyBrDbnh57cpbJLyns:coXxFGWL56BVrDbn77cjIs
MD5 SHA1 SHA512 SSDEEP

windows:6 windows x64 arch:x64

Detects BazaLoader malware

BazaLoader is a trojan that transmits logs to the Command and Control (C2) server, encoding them in BASE64 format through GET requests.

trojan
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

64248

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

advapi32

RegGetValueA

kernel32

GetModuleFileNameW K32GetModuleFileNameExW SetThreadPriority CreatePipe GetTempPathW lstrlenA CreateMutexA GetVolumeInformationA WaitForSingleObject CreateFileW ReleaseMutex lstrcatA GetModuleHandleA OpenProcess CreateToolhelp32Snapshot Sleep GetModuleHandleExA GetLastError Process32NextW CreateFileA GetCurrentThread TerminateProcess lstrcatW DeleteFileA lstrcpyA Process32FirstW CloseHandle GetNativeSystemInfo CreateThread GetWindowsDirectoryA HeapAlloc GetWindowsDirectoryW GetProcAddress ExitProcess GetProcessHeap CreateProcessW FreeLibrary CopyFileW WinExec GetTempFileNameW CreateProcessA IsBadReadPtr QueryPerformanceCounter SetUnhandledExceptionFilter HeapSize FlushFileBuffers VirtualAlloc WriteFile GetCurrentProcess VirtualFree SetLastError HeapFree VirtualProtect GetModuleFileNameA ReadFile LoadLibraryA CreateDirectoryW GetStringTypeW SetEnvironmentVariableW FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineW GetCommandLineA GetCPInfo GetOEMCP GetACP IsValidCodePage FindNextFileW FindFirstFileExW WriteConsoleW FindClose GetTimeZoneInformation SetFilePointerEx SetStdHandle LCMapStringW CompareStringW GetTimeFormatW GetDateFormatW GetConsoleMode GetConsoleOutputCP WideCharToMultiByte HeapReAlloc GetCurrentProcessId GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind IsDebuggerPresent UnhandledExceptionFilter GetStartupInfoW IsProcessorFeaturePresent GetModuleHandleW RtlUnwindEx EnterCriticalSection LeaveCriticalSection DeleteCriticalSection InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree LoadLibraryExW RaiseException GetModuleHandleExW GetFileType GetStdHandle MultiByteToWideChar

shell32

ShellExecuteExW

shlwapi

StrStrIW StrStrIA

secur32

GetUserNameExA

wininet

HttpQueryInfoA HttpOpenRequestA InternetOpenUrlA InternetSetOptionA InternetOpenA InternetCloseHandle HttpSendRequestA InternetConnectA InternetReadFile

ws2_32

__WSAFDIsSet closesocket WSAGetLastError setsockopt ioctlsocket htons getsockopt recv connect socket WSACleanup WSAStartup send inet_addr select

Name

.text

Size

166KB

Virtual Size

168KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

65KB

Virtual Size

68KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.data

Size

4.9MB

Virtual Size

6.0MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

8KB

Virtual Size

8KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

IDATA

Size

7KB

Virtual Size

12KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.SCY

Size

4KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Resubmissions

Sharing

General

Malware Config

Signatures

File Explorer

svchost_dump_SCY - Copy.bin.zip

svchost_dump_SCY - Copy.bin

advapi32

kernel32

shell32

shlwapi

secur32

wininet

ws2_32

generic