🤲🏼 NEW | abuse.ch Community Hub! Earn recognition 🏅 for the malware intelligence you share, climb the leaderboards 📈, and connect with like-minded contributors who share your hunting focus 🤝. Ready to unlock your profile? Go to the Community Hub →

MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 00ea1024d5bbfbbb5898ffcd8ba53b3a5010c79cf0551010d77976509a60bce2. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Neurevt


Vendor detections: 10


Intelligence 10 IOCs 5 YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 00ea1024d5bbfbbb5898ffcd8ba53b3a5010c79cf0551010d77976509a60bce2
SHA3-384 hash: ceb4119fe46cae2bc146e91822573dc8cd75f08b9822c8be15067adae140a1d4034d41bcd37be0b76330307dadb035ba
SHA1 hash: f6931f17ee7231cb4313ccd3338088cd612e662e
MD5 hash: ce33ab7f846c1916c1f780cfefbe97dc
humanhash: virginia-texas-sad-connecticut
File name:ce33ab7f846c1916c1f780cfefbe97dc.exe
Download: download sample
Signature Neurevt
Create hunting rule
File size:433'366 bytes
First seen:2022-10-01 10:05:35 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash 890e522b31701e079a367b89393329e6 (27 x Formbook, 12 x AgentTesla, 8 x Loda)
ssdeep 6144:duIlWqB+ihabs7Ch9KwyF5LeLodp2D1Mmakda0qL4g3xs8pMoOB1by9AaSE6:w6Wq4aaE6KwyF5L0Y2D1PqLV4q6
TLSH T1EE9423FF6B71AD12F97C0BBAFB551353C8D03232D3B9A635606001536CAF0196E966C9
TrID 87.0% (.EXE) AutoIt3 compiled script executable (510622/80/67)
4.6% (.EXE) UPX compressed Win32 Executable (27066/9/6)
4.5% (.EXE) Win32 EXE Yoda's Crypter (26569/9/4)
1.1% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
0.8% (.EXE) Win16 NE executable (generic) (5038/12/1)
File icon (PE):PE icon
dhash icon 0000000000000000 (907 x AgentTesla, 573 x Formbook, 316 x RedLineStealer)
Reporter abuse_ch
Tags:exe Neurevt


Avatar
abuse_ch
Neurevt C2:
http://www.sahebzaman.org/includes/css/load.php

Indicators Of Compromise (IOCs)

Below is a list of indicators of compromise (IOCs) associated with this malware samples.

IOCThreatFox Reference
http://www.sahebzaman.org/includes/css/load.php https://threatfox.abuse.ch/ioc/865900/
http://mayoristas.divisared.es/ajax/support.php https://threatfox.abuse.ch/ioc/865902/
http://www.globsyn.com/stylesheet/text/info.php https://threatfox.abuse.ch/ioc/865903/
http://ns1.globsynbschool.com/wp-poster.php https://threatfox.abuse.ch/ioc/865904/
http://www.climetrics.com/wp-includes/js/swf/wp-form.php https://threatfox.abuse.ch/ioc/865905/

Intelligence

File Origin
# of uploads :
1
# of downloads :
266
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/315463/
Detection(s):
PUA.Win.Packer.Upx-4
Create hunting rule

Win.Trojan.Agent-7654972-0
Create hunting rule

SecuriteInfo.com.PSW.Banker6.BTQY.1690.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
Enabling the 'hidden' option for analyzed file
Creating a file in the %temp% directory
Unauthorized injection to a recently created process
Adding an access-denied ACE
Сreating synchronization primitives
Launching a process
Creating a process with a hidden window
Forced system process termination
Launching the default Windows debugger (dwwin.exe)
Launching a service
DNS request
Possible injection to a system process
Enabling autorun with the standard Software\Microsoft\Windows\CurrentVersion\Run registry branch
Moving of the original file
Enabling autorun for a service
Query of malicious DNS domain
Unauthorized injection to a system process
Forced shutdown of a browser
Result
Malware family:
n/a
Score:
  9/10
Tags:
n/a
Link:
https://dragonfly.certego.net/analysis/40404/overview
Behaviour
MalwareBazaar
CheckNumberOfProcessor
SystemUptime
MeasuringTime
EvasionGetTickCount
CheckCmdLine
EvasionQueryPerformanceCounter
Verdict:
Suspicious
Threat level:
  5/10
Confidence:
67%
Tags:
betabot neurevt overlay packed shell32.dll
Link:
https://www.filescan.io/uploads/6338110ad089a0c15dd32e2c/reports/554f240a-ecf3-40a5-a4f7-77ed10323d9a/overview
Verdict:
Unknown
Link:
https://analyze.intezer.com/analyses/ddec9e31-367d-4274-939e-6ca1f2cc0b53
Result
Threat name:
Betabot
Create hunting rule
Detection:
malicious
Classification:
phis.troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1081481
Signature
Antivirus / Scanner detection for submitted sample
Antivirus detection for URL or domain
Creates an undocumented autostart registry key
Creates multiple autostart registry keys
Found evasive API chain (may stop execution after reading information in the PEB, e.g. number of processors)
Hides that the sample has been downloaded from the Internet (zone.identifier)
Hides threads from debuggers
Injects a PE file into a foreign processes
Maps a DLL or memory area into another process
Modifies Internet Explorer zone settings
Multi AV Scanner detection for domain / URL
Multi AV Scanner detection for submitted file
Overwrites Windows DLL code with PUSH RET codes
Sample uses process hollowing technique
Snort IDS alert for network traffic
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Tries to detect virtualization through RDTSC time measurements
Tries to harvest and steal ftp login credentials
Uses schtasks.exe or at.exe to add and modify task schedules
Yara detected Betabot
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 714038 Sample: jCz9m6TavX.exe Startdate: 01/10/2022 Architecture: WINDOWS Score: 100 47 Snort IDS alert for network traffic 2->47 49 Multi AV Scanner detection for domain / URL 2->49 51 Antivirus detection for URL or domain 2->51 53 4 other signatures 2->53 8 jCz9m6TavX.exe 2 2 2->8         started        11 dsxapzcdb.exe 2 1 2->11         started        13 dsxapzcdb.exe 1 2->13         started        process3 signatures4 63 Found evasive API chain (may stop execution after reading information in the PEB, e.g. number of processors) 8->63 65 Creates multiple autostart registry keys 8->65 67 Uses schtasks.exe or at.exe to add and modify task schedules 8->67 69 Tries to detect virtualization through RDTSC time measurements 8->69 15 jCz9m6TavX.exe 4 21 8->15         started        71 Injects a PE file into a foreign processes 11->71 18 dsxapzcdb.exe 1 12 11->18         started        20 dsxapzcdb.exe 12 13->20         started        process5 signatures6 77 Creates an undocumented autostart registry key 15->77 79 Maps a DLL or memory area into another process 15->79 81 Sample uses process hollowing technique 15->81 83 Hides that the sample has been downloaded from the Internet (zone.identifier) 15->83 22 WerFault.exe 7 40 15->22         started        26 schtasks.exe 1 15->26         started        28 svchost.exe 15->28         started        process7 dnsIp8 41 mayoristas.divisared.es 46.24.31.188, 49708, 80 VODAFONE_ESES Spain 22->41 43 www.climetrics.com 86.105.245.69, 49713, 80 TRANSIP-ASAmsterdamtheNetherlandsNL Netherlands 22->43 45 10 other IPs or domains 22->45 55 Creates multiple autostart registry keys 22->55 57 Overwrites Windows DLL code with PUSH RET codes 22->57 59 Modifies Internet Explorer zone settings 22->59 61 4 other signatures 22->61 30 zkcZCHpyCFnJ.exe 1 12 22->30 injected 33 dsxapzcdb.exe 1 12 22->33         started        35 zkcZCHpyCFnJ.exe 1 12 22->35 injected 39 17 other processes 22->39 37 conhost.exe 26->37         started        signatures9 process10 signatures11 73 Hides threads from debuggers 30->73 75 Hides that the sample has been downloaded from the Internet (zone.identifier) 30->75
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/00ea1024d5bbfbbb5898ffcd8ba53b3a5010c79cf0551010d77976509a60bce2/
Threat name:
Win32.Spyware.Plimrost
Create hunting rule
Status:
Malicious
First seen:
2014-11-17 19:26:00 UTC
File Type:
PE (Exe)
Extracted files:
23
AV detection:
25 of 29 (86.21%)
Threat level:
  2/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=advbajgvxp53wwey77gyxjj3hjibbr446bkraegxpf3fbgtaxtra._file
Verdict:
malicious
Result
Malware family:
n/a
Score:
  8/10
Tags:
persistence upx
Link:
https://tria.ge/reports/221001-l43pgafgg2/
Behaviour
Checks processor information in registry
Creates scheduled task(s)
Modifies registry class
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: MapViewOfSection
Suspicious behavior: RenamesItself
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
AutoIT Executable
Suspicious use of SetThreadContext
Adds Run key to start application
Checks for any installed AV software in registry
Drops desktop.ini file(s)
Checks computer location settings
Loads dropped DLL
Executes dropped EXE
Sets file execution options in registry
UPX packed file
Verdict:
Malicious
Tags:
n/a
YARA:
n/a
Link:
https://app.threat.zone/submission/e78b90e0-001b-4346-b855-ee3d04224812
Unpacked files
SH256 hash:
00ea1024d5bbfbbb5898ffcd8ba53b3a5010c79cf0551010d77976509a60bce2
MD5 hash:
ce33ab7f846c1916c1f780cfefbe97dc
SHA1 hash:
f6931f17ee7231cb4313ccd3338088cd612e662e
Link:
https://www.unpac.me/results/70b159a3-75ac-4d6f-8338-b99180c75b0e/
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/00ea1024d5bb/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Betabot
Score:
0.90
Link:
https://yomi.yoroi.company/submissions/00ea1024d5bbfbbb5898ffcd8ba53b3a5010c79cf0551010d77976509a60bce2

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/315463/

Comments