MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 00ee1a5396b9c326f5e1bf4bdb03dc60c5ecf65d3e0ec53cd471886f400c1d9b. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

TeamBot

Vendor detections: 15

Intelligence 15 IOCs YARA 1 File information Comments

SHA256 hash:	00ee1a5396b9c326f5e1bf4bdb03dc60c5ecf65d3e0ec53cd471886f400c1d9b
SHA3-384 hash:	814def2d229da13cfc770638b7dd9feeeb6e4489678b74b0f98bf4e008bfa635c59a53284aeeb1ea888f7cc0b2ed00b0
SHA1 hash:	61813db3c4251328ed6947313fc1de4d8996a4c3
MD5 hash:	6694844ff96fb5e2d9c9396514021ed4
humanhash:	july-mars-football-mexico
File name:	6694844ff96fb5e2d9c9396514021ed4.exe
Download:	download sample
Signature	TeamBot Create hunting rule
File size:	903'168 bytes
First seen:	2022-12-07 07:30:15 UTC
Last seen:	Never
File type:	exe
MIME type:	application/x-dosexec
imphash	a56934040bb7998eb09f75c554f918ec (19 x Amadey, 3 x Smoke Loader, 1 x TeamBot)
ssdeep	12288:SJABkYSiKYgtLnpnFpm0+X5AIjneys82yswvfnTci7WhgPc6RQ6GAf9uo31b2scq:STYLgZBFY0CPetwDcIWhk/kfkcWCi
Threatray	2'720 similar samples on MalwareBazaar
TLSH	T1FA151200F6B0D473E5820174182ACAF076FEE4E39924951777EC7B6FAEB239099B1749
TrID	47.3% (.EXE) Win32 Executable MS Visual C++ (generic) (31206/45/13) 15.9% (.EXE) Win64 Executable (generic) (10523/12/4) 9.9% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2) 7.6% (.EXE) Win16 NE executable (generic) (5038/12/1) 6.8% (.EXE) Win32 Executable (generic) (4505/5/1)
File icon (PE):
dhash icon	c11edecea68c8ccc (11 x Smoke Loader, 10 x Amadey, 1 x ArkeiStealer)
Reporter	abuse_ch
Tags:	exe TeamBot

abuse_ch

TeamBot C2:
http://abibiall.com/test1/get.php

Intelligence

File Origin

# of uploads :

# of downloads :

194

Origin country :

n/a

Vendor Threat Intelligence

Malware family:

vidar

ID:

File name:

6694844ff96fb5e2d9c9396514021ed4.exe

Verdict:

Malicious activity

Analysis date:

2022-12-07 07:33:04 UTC

Tags:

trojan loader stealer vidar

Link:

https://app.any.run/tasks/413c7fd7-0db6-4116-a873-1e6592423b92

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

Detection:

STOP

Link:

https://www.capesandbox.com/analysis/343756/

Detection(s):

Win.Packer.pkr_ce1a-9980177-0

Result

Verdict:

Malware

Maliciousness:

Behaviour

Searching for the window

Creating a window

Unauthorized injection to a recently created process

Sending an HTTP GET request

Creating a file

Launching a process

Creating a process with a hidden window

Adding an access-denied ACE

Sending a custom TCP request

Сreating synchronization primitives

Deleting a recently created file

DNS request

Query of malicious DNS domain

Sending a TCP request to an infection source

Enabling autorun with the standard Software\Microsoft\Windows\CurrentVersion\Run registry branch

Enabling autorun by creating a file

Sending an HTTP GET request to an infection source

Verdict:

Malicious

Threat level:

10/10

Confidence:

100%

Tags:

azorult greyware lockbit packed

Link:

https://www.filescan.io/uploads/6390413704e0e79bdf413e6e/reports/4fbd9349-71a7-4709-969e-72690032de34/overview

Result

Verdict:

UNKNOWN

Details

Windows PE Executable

Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.

Malware family:

STOP Ransomware

Verdict:

Malicious

Link:

https://analyze.intezer.com/analyses/2e760244-9157-4b07-9cb0-561f6187ae4f

Result

Threat name:

Djvu

Detection:

malicious

Classification:

rans.troj.evad

Score:

76 / 100

Link:

https://www.joesandbox.com/analysis/1129676

Signature

C2 URLs / IPs found in malware configuration

Injects a PE file into a foreign processes

Machine Learning detection for sample

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Yara detected Djvu Ransomware

Behaviour

Behavior Graph:

Download SVG

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/00ee1a5396b9c326f5e1bf4bdb03dc60c5ecf65d3e0ec53cd471886f400c1d9b/

Threat name:

Win32.Trojan.SmokeLoader

Status:

Malicious

First seen:

2022-12-07 05:24:41 UTC

File Type:

PE (Exe)

Extracted files:

AV detection:

22 of 25 (88.00%)

Threat level:

5/5

Detection(s):

Malicious file

Link:

https://check.spamhaus.org/check/?searchterm=adxbuu4wxhbsn5pbx5f5wa64mdc6z5s5hyhmkpguogeg6qamdwnq._file

Verdict:

malicious

TeamBot

3d61799098595a74aa43cc391c11beea14044a4ccbe27dfcff887ed5a74544f4

TeamBot

43f822b1220756e8484429635c2de1d11565e1c1de484c735dde760b06033867

TeamBot

5aad6ebccf994b06ae04f81acb19cbf976cea52e91671b5375c9c5d37dbb7098

TeamBot

6b2e3ed5c3e90f211fd187a2a010054d4ce49d3d1a3cdc03468d484f8e4adadb

TeamBot

a5c5875892fcf16b14b95f13bc01d686f6127877cc1562721a8182db00c92912

TeamBot

b97dfdb8e99e26332aea46dd075c02bd1cbdaed0edc04423422e2ca5818c301b

TeamBot

b990ed5485491482b2c8ee144a2fa5998aaa8fc5575b0ed740e85c40d750721b

TeamBot

+ 2'710 additional samples on MalwareBazaar

Result

Malware family:

vidar

Score:

10/10

Tags:

family:djvu family:vidar botnet:517 discovery persistence ransomware spyware stealer

Link:

https://tria.ge/reports/221207-jcdj6afe97/

Behaviour

Checks processor information in registry

Creates scheduled task(s)

Delays execution with timeout.exe

Modifies system certificate store

Suspicious behavior: EnumeratesProcesses

Suspicious use of WriteProcessMemory

Enumerates physical storage devices

Suspicious use of SetThreadContext

Accesses 2FA software files, possible credential harvesting

Accesses cryptocurrency files/wallets, possible credential harvesting

Adds Run key to start application

Checks installed software on the system

Looks up external IP address via web service

Checks computer location settings

Loads dropped DLL

Modifies file permissions

Reads user/profile data of web browsers

Downloads MZ/PE file

Executes dropped EXE

Detected Djvu ransomware

Djvu Ransomware

Vidar

Malware Config

C2 Extraction:

http://abibiall.com/test1/get.php
https://t.me/dishasta
https://steamcommunity.com/profiles/76561199441933804

Verdict:

Informative

Tags:

n/a

YARA:

n/a

Link:

https://app.threat.zone/submission/b895f871-88bd-443a-89cb-a2b94c232334

Unpacked files

SH256 hash:

be01e7adefbf6b3eaa9f26ef8132ab6ea58042ef464bd0c17ee1cbddec1173b4

MD5 hash:

17aacf9f4c158a0206e71e6216248139

SHA1 hash:

5a1ab595b4412c4229fb86482f9dff037f41ebcf

Detections:

win_stop_auto

Link:

https://www.unpac.me/results/da406d2e-9399-45b2-ac98-933f64bbc969/

Parent samples :

00ee1a5396b9c326f5e1bf4bdb03dc60c5ecf65d3e0ec53cd471886f400c1d9b
3d61799098595a74aa43cc391c11beea14044a4ccbe27dfcff887ed5a74544f4
c867502d48b3716cd863de5e8e0047e3d829d2a2db9d98750ebfc28d1585b641
9f17bc1d692c8fa0305756444521f1f664d133e64b7bf058f93ae1e24a418264
56d69865665bf33e1256eb0fa2cd50f596c9bbf8abe0cac09c41037a9d667a31
0f42167e3b9736a4e1c33e4d99255ac37963d96756ffa772885fbaa4c493a21a
dbab3a22dcc5927c28a4e3772b794bb559bdfca088216de8351ae21886587884

SH256 hash:

00ee1a5396b9c326f5e1bf4bdb03dc60c5ecf65d3e0ec53cd471886f400c1d9b

MD5 hash:

6694844ff96fb5e2d9c9396514021ed4

SHA1 hash:

61813db3c4251328ed6947313fc1de4d8996a4c3

Link:

https://www.unpac.me/results/da406d2e-9399-45b2-ac98-933f64bbc969/

Malware family:

STOP

Verdict:

Malicious

Link:

https://www.vmray.com/analyses/_mb/00ee1a5396b9/report/overview.html

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/00ee1a5396b9c326f5e1bf4bdb03dc60c5ecf65d3e0ec53cd471886f400c1d9b

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.