MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 054b7c5d38a00ecfc40168d4dc21610139c5ab6a46d2a0e851ef100397d5e5e9. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Neurevt


Vendor detections: 8


Intelligence 8 IOCs YARA 4 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 054b7c5d38a00ecfc40168d4dc21610139c5ab6a46d2a0e851ef100397d5e5e9
SHA3-384 hash: 131888797a796e68a241a099a2038f4997d12039830a66fbdacdb448c363ef1d045c5d5cd229f34cf6de75b07ddb9373
SHA1 hash: df95aa3ea7a3fbc66ced0615491ee7e656f09a52
MD5 hash: 8a9aae01cda806a3da1bbb8bdb40da3f
humanhash: early-two-triple-twenty
File name:Product_item.exe
Download: download sample
Signature Neurevt
Create hunting rule
File size:949'248 bytes
First seen:2020-10-12 06:08:28 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'749 x AgentTesla, 19'653 x Formbook, 12'246 x SnakeKeylogger)
ssdeep 12288:sAOLgwGMnW1DytbXmZXuRPy7mwkq9H3sewKoTvDsz6JnroYNtOruZI1RZagIiKuX:sLgNMW1Dyyk2H3sn9vwzmrxpwXKuxr
Threatray 206 similar samples on MalwareBazaar
TLSH 8315D06332E51F89D8BE8BFD461828E003B7BD6F6126E14D3DC254EF05E2B416615B2B
Reporter abuse_ch
Tags:exe Neurevt


Avatar
abuse_ch
Malspam distributing Neurevt:

HELO: ns20.hyyat4host.com
Sending IP: 138.201.62.222
From: tamer_diab@alrosan.com.sa
Subject: Inquiry for product
Attachment: Product_item.gz (contains "Product_item.exe")

Neurevt C2:
http://cwjamaica.us/hm/logout.php

Intelligence

File Origin
# of uploads :
1
# of downloads :
96
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/69937/
Result
Verdict:
Malware
Maliciousness:

Behaviour
Sending a UDP request
Creating a window
Unauthorized injection to a recently created process
Creating a file
Adding an access-denied ACE
Launching a process
Unauthorized injection to a browser process
Moving of the original file
Enabling autorun for a service
Firewall traversal
Setting a single autorun event
Enabling autorun with the standard Software\Microsoft\Windows\CurrentVersion\Run registry branch
Changing settings of the browser security zones
Unauthorized injection to a system process
Enabling autorun
Result
Threat name:
Betabot
Create hunting rule
Detection:
malicious
Classification:
phis.troj.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/487982
Signature
.NET source code contains potential unpacker
Contains functionality to check if a debugger is running (CheckRemoteDebuggerPresent)
Contains functionality to create processes via WMI
Creates an undocumented autostart registry key
Early bird code injection technique detected
Hides that the sample has been downloaded from the Internet (zone.identifier)
Hides threads from debuggers
Injects a PE file into a foreign processes
Machine Learning detection for sample
Maps a DLL or memory area into another process
Modifies Internet Explorer zone settings
Multi AV Scanner detection for submitted file
Overwrites Windows DLL code with PUSH RET codes
Queues an APC in another process (thread injection)
Sample uses process hollowing technique
Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)
System process connects to network (likely due to code injection or exploit)
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Tries to detect sandboxes and other dynamic analysis tools (window names)
Writes to foreign memory regions
Yara detected AntiVM_3
Yara detected Betabot
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 296441 Sample: Product_item.exe Startdate: 12/10/2020 Architecture: WINDOWS Score: 100 58 Snort IDS alert for network traffic (e.g. based on Emerging Threat rules) 2->58 60 Multi AV Scanner detection for submitted file 2->60 62 Yara detected AntiVM_3 2->62 64 7 other signatures 2->64 8 Product_item.exe 3 2->8         started        12 9o7ak7c955uaue7.exe 2->12         started        14 9o7ak7c955uaue7.exe 3 2->14         started        16 2 other processes 2->16 process3 file4 44 C:\Users\user\...\Product_item.exe.log, ASCII 8->44 dropped 82 Injects a PE file into a foreign processes 8->82 18 Product_item.exe 12 25 8->18         started        84 Early bird code injection technique detected 12->84 21 9o7ak7c955uaue7.exe 12->21         started        23 9o7ak7c955uaue7.exe 12->23         started        25 9o7ak7c955uaue7.exe 14->25         started        27 9o7ak7c955uaue7.exe 16->27         started        29 9o7ak7c955uaue7.exe 16->29         started        signatures5 process6 signatures7 66 Creates an undocumented autostart registry key 18->66 68 Maps a DLL or memory area into another process 18->68 70 Sample uses process hollowing technique 18->70 72 Hides that the sample has been downloaded from the Internet (zone.identifier) 18->72 31 explorer.exe 18 48 18->31         started        74 Hides threads from debuggers 25->74 76 Queues an APC in another process (thread injection) 25->76 process8 dnsIp9 46 cwjamaica.us 45.153.203.141, 49758, 80 NETLABFR Netherlands 31->46 48 192.168.2.1 unknown unknown 31->48 50 System process connects to network (likely due to code injection or exploit) 31->50 52 Overwrites Windows DLL code with PUSH RET codes 31->52 54 Modifies Internet Explorer zone settings 31->54 56 4 other signatures 31->56 35 dOYJMgwzhqSujbmXFzeeGXWDRt.exe 1 23 31->35 injected 38 dOYJMgwzhqSujbmXFzeeGXWDRt.exe 1 23 31->38 injected 40 dOYJMgwzhqSujbmXFzeeGXWDRt.exe 31->40 injected 42 8 other processes 31->42 signatures10 process11 signatures12 78 Hides threads from debuggers 35->78 80 Hides that the sample has been downloaded from the Internet (zone.identifier) 35->80
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/054b7c5d38a00ecfc40168d4dc21610139c5ab6a46d2a0e851ef100397d5e5e9/
Threat name:
ByteCode-MSIL.Backdoor.SpyNoon
Create hunting rule
Status:
Malicious
First seen:
2020-10-12 05:13:47 UTC
AV detection:
21 of 29 (72.41%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=avfxyxjyuahm7rabndknyilbae44lk3ki3jkb2cr54iahf6v4xuq._file
Verdict:
malicious
Similar samples:
2962eba90f4c76463186e170ae32e1ad8ed50b589a83bee7016dc942b80cd0df
Neurevt
46387625361cd440a23520b7bda25f402b586d00a44229754ab776e5e1bf34f7
Neurevt
8d6e4671da660a178432514e56aaf7445ea4f03a60f20cc9b6d29826ab435975
Neurevt
bd476e4d4bb6f46ca0e62c6a2ab34f90b025d3cc6a0895be9073bd48997d1b47
Neurevt
c021395bee57f945cfcd348ddc3d589b004c8575afa1718bd9a60774fde7c2a9
Neurevt
d335fad41e3f9b09effaf617e6c56554b667191c9c94f4b644a15b396408858b
Neurevt
d3aa9fd1ed4af3cc3a49e612b93a03f799ada340c1c086f7403448fe77115bb1
Neurevt
dcafd8ba263cf7e448be257a8d25c968a0060908f93f9d02a068bb0dd482879f
Neurevt
e63df6a7f5c2a30456c884959644745ee0174df416492324c5ee31635958f855
Neurevt
fcaa4b93dbdb7ca43dab06e0afb63117ca21a864f7ccf6f6eb7a4581ded48464
Neurevt
+ 196 additional samples on MalwareBazaar
Result
Malware family:
betabot
Create hunting rule
Score:
  10/10
Tags:
evasion trojan backdoor botnet family:betabot persistence
Link:
https://tria.ge/reports/201012-2zmkhbsh5n/
Behaviour
Checks processor information in registry
Enumerates system info in registry
Modifies Internet Explorer Protected Mode
Modifies Internet Explorer Protected Mode Banner
Modifies Internet Explorer settings
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: MapViewOfSection
Suspicious behavior: RenamesItself
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Suspicious use of NtSetInformationThreadHideFromDebugger
Suspicious use of SetThreadContext
Adds Run key to start application
Checks whether UAC is enabled
Drops desktop.ini file(s)
Checks BIOS information in registry
Sets file execution options in registry
BetaBot
Modifies firewall policy service
Unpacked files
SH256 hash:
607f04646c9f16f7c23fa69d4b8f660fc7c44d40e4f73a0c70a2b315debdaa8b
MD5 hash:
a90baadadf904455325f7bc787185c7b
SHA1 hash:
7d833bb819d638008c98be469b05db2feaf201cd
Link:
https://www.unpac.me/results/525c79f4-9dcb-4d92-8757-642c6540224e/
SH256 hash:
2ad318a1cfede4cb9eb3731b38117c070694af5d67914372913064d16d44b31f
MD5 hash:
d9508410cfbb9faa1410e1d5111dffaf
SHA1 hash:
801c034776096c23428e5a3ea751f252cd17c878
Link:
https://www.unpac.me/results/525c79f4-9dcb-4d92-8757-642c6540224e/
SH256 hash:
0aa9cbee7ea2ed3b1a3b672af918700aabac4ba558de24827fbb8ee7de6a72c5
MD5 hash:
7db36bd1e5faf1f224aeba7a91ff0f26
SHA1 hash:
9e65d06203b4c297fe0636c8192f25452df7884b
Link:
https://www.unpac.me/results/525c79f4-9dcb-4d92-8757-642c6540224e/
SH256 hash:
054b7c5d38a00ecfc40168d4dc21610139c5ab6a46d2a0e851ef100397d5e5e9
MD5 hash:
8a9aae01cda806a3da1bbb8bdb40da3f
SHA1 hash:
df95aa3ea7a3fbc66ced0615491ee7e656f09a52
Link:
https://www.unpac.me/results/525c79f4-9dcb-4d92-8757-642c6540224e/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Suspicious File
Score:
0.65
Link:
https://yomi.yoroi.company/submissions/054b7c5d38a00ecfc40168d4dc21610139c5ab6a46d2a0e851ef100397d5e5e9

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:Steam_stealer_bin_mem
Create hunting rule
Author:James_inthe_box
Description:Steam in files like avemaria
Rule name:UAC_bypass_bin_mem
Create hunting rule
Author:James_inthe_box
Description:UAC bypass in files like avemaria
Rule name:VMware_detection_bin_mem
Create hunting rule
Author:James_inthe_box
Description:VMWare detection
Rule name:win_betabot_w0
Create hunting rule
Author:Venom23
Description:Neurevt Malware Sig

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Neurevt

gz 186a704347869cc833fefdd197db329f6a061353ce84354b7d0a14ef4adc0e9b

Neurevt

Executable exe 054b7c5d38a00ecfc40168d4dc21610139c5ab6a46d2a0e851ef100397d5e5e9

(this sample)

  
Dropped by
MD5 3e148b6a78cd3fdf6eb52edb9967d8f1
  
Delivery method
Distributed via e-mail attachment
Cape
Cape
https://www.capesandbox.com/analysis/69937/
  
Dropped by
SHA256 186a704347869cc833fefdd197db329f6a061353ce84354b7d0a14ef4adc0e9b

Comments