MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 37f72d7cc30ac6952775a5972e510e0f2e0163b11ac7dea1e4dc0449dd8e633a. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Backdoor.TeamViewer


Vendor detections: 11


Intelligence 11 IOCs YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 37f72d7cc30ac6952775a5972e510e0f2e0163b11ac7dea1e4dc0449dd8e633a
SHA3-384 hash: 2beb66f9d783bd5c7440353e05e84838e9910fb58afd68a669988fe3f09ab6bb41d65af082ad03b329d64ab801304f9d
SHA1 hash: ba5ac15491d919d5b4ecc07b345e45336700bb45
MD5 hash: eaf2482f308de7dec8e73a0f92f2e1cf
humanhash: asparagus-california-hotel-magazine
File name:file
Download: download sample
Signature Backdoor.TeamViewer
Create hunting rule
File size:1'276'180 bytes
First seen:2023-09-05 01:30:26 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash 80417b621299e3e1de617305557a3c68 (48 x GCleaner, 44 x Backdoor.TeamViewer, 31 x Socks5Systemz)
ssdeep 24576:yI39d/vc6pS61TRXmTrqUvaXbyTzqSIPz8twDmROEyFV/uN4vxt:y6dMGpTRXKzBzq1L8OmgjuCt
Threatray 825 similar samples on MalwareBazaar
TLSH T177452347E686807ED06288745C3B9959943B7B35297CB50D77DC4E8CCF33A60EC0ABA6
TrID 50.8% (.EXE) Win32 Executable PowerBASIC/Win 9.x (148303/79/28)
37.6% (.EXE) Inno Setup installer (109740/4/30)
4.8% (.EXE) Win32 Executable Delphi generic (14182/79/4)
2.2% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
1.5% (.EXE) Win32 Executable (generic) (4505/5/1)
File icon (PE):PE icon
dhash icon b298acbab2ca7a72 (2'327 x GCleaner, 1'631 x Socks5Systemz, 67 x RedLineStealer)
Reporter andretavare5
Tags:Backdoor.TeamViewer exe


Avatar
andretavare5
Sample downloaded from http://myfilebest.com/order/set17.exe

Intelligence

File Origin
# of uploads :
1
# of downloads :
298
Origin country :
US US
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
file
Verdict:
Malicious activity
Analysis date:
2023-09-05 01:33:15 UTC
Tags:
installer
Link:
https://app.any.run/tasks/449392a7-10be-4992-84e4-de190fbcac10

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/446180/
Detection(s):
SecuriteInfo.com.Trojan.DownLoader25.56768.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a file in the %temp% subdirectories
Creating a window
Creating a process from a recently created file
Сreating synchronization primitives
Searching for the window
Creating a file in the Program Files subdirectories
Moving a file to the Program Files subdirectory
Launching the process to interact with network services
Modifying a system file
Launching a process
Creating a file
Creating a service
Sending a custom TCP request
Enabling autorun for a service
Gathering data
Verdict:
Suspicious
Threat level:
  5/10
Confidence:
100%
Tags:
control greyware installer lolbin overlay packed packed shell32
Link:
https://www.filescan.io/uploads/64f684d767511af1a1b490f2/reports/419967c0-33e0-4e03-b619-6cccb1cb430a/overview
Verdict:
Malicious
Link:
https://www.hybrid-analysis.com/sample/37f72d7cc30ac6952775a5972e510e0f2e0163b11ac7dea1e4dc0449dd8e633a
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Verdict:
Unknown
Link:
https://analyze.intezer.com/analyses/d55fa621-4237-446f-9691-1929331cfaea
Result
Threat name:
n/a
Detection:
malicious
Classification:
evad
Score:
96 / 100
Link:
https://www.joesandbox.com/analysis/1303185
Signature
Antivirus detection for URL or domain
Contains functionality to infect the boot sector
Detected unpacking (changes PE section rights)
Detected unpacking (overwrites its own PE header)
Found API chain indicative of debugger detection
Found stalling execution ending in API Sleep call
Machine Learning detection for dropped file
Multi AV Scanner detection for submitted file
Snort IDS alert for network traffic
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 1303185 Sample: file.exe Startdate: 05/09/2023 Architecture: WINDOWS Score: 96 50 Snort IDS alert for network traffic 2->50 52 Antivirus detection for URL or domain 2->52 54 Multi AV Scanner detection for submitted file 2->54 56 6 other signatures 2->56 8 file.exe 2 2->8         started        11 svchost.exe 1 2->11         started        13 svchost.exe 1 2->13         started        15 svchost.exe 1 2->15         started        process3 file4 42 C:\Users\user\AppData\Local\...\is-ELCB6.tmp, PE32 8->42 dropped 17 is-ELCB6.tmp 10 20 8->17         started        process5 file6 32 C:\Users\user\AppData\Local\...\_setup64.tmp, PE32+ 17->32 dropped 34 C:\Users\user\AppData\Local\...\_isdecmp.dll, PE32 17->34 dropped 36 C:\Users\user\AppData\Local\...\_iscrypt.dll, PE32 17->36 dropped 38 6 other files (5 malicious) 17->38 dropped 20 previewer.exe 1 17 17->20         started        23 previewer.exe 1 3 17->23         started        26 net.exe 1 17->26         started        process7 dnsIp8 44 aacovii.ru 185.141.63.172, 49750, 80 BELCLOUDBG Bulgaria 20->44 46 195.154.176.209, 1074, 49751 OnlineSASFR France 20->46 48 datasheet.fun 172.67.166.109, 49746, 80 CLOUDFLARENETUS United States 20->48 40 C:\ProgramData\...\ContentDWSvc.exe, PE32 23->40 dropped 28 conhost.exe 26->28         started        30 net1.exe 1 26->30         started        file9 process10
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/37f72d7cc30ac6952775a5972e510e0f2e0163b11ac7dea1e4dc0449dd8e633a/
Threat name:
Win32.Trojan.Generic
Create hunting rule
Status:
Malicious
First seen:
2023-09-05 01:31:06 UTC
File Type:
PE (Exe)
Extracted files:
5
AV detection:
11 of 24 (45.83%)
Threat level:
  2/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=g73s27gdbldjkj3vuwls4uiob4xacy5rdld55ipe3qcetxmomm5a._file
Verdict:
malicious
Similar samples:
18a003b69166425415dd944dad47c33490eb9196780f29802296d80a301e1548
Backdoor.TeamViewer
3476601196502ae5aacb48ab2a6b0b1089100c0761f563c2cdb86861bc18798d
Backdoor.TeamViewer
4d5e8970cac0c4a712788ba6d0ea6a3ad3e842dbeb61480b1f58bd0408497dbc
Backdoor.TeamViewer
501283772e11d99ca3cb7bb173b79029de83d237cf68eddd07b6b105a1b39cb4
Backdoor.TeamViewer
6cccc777cf4eeebb2a17f4d13732f5dfeb0f6dbf50e6b96c743f101c481a44b6
Backdoor.TeamViewer
9053d2ad5fc31e78eec56fd8ac9f5a5330b568ab7880b54941ed0c9d6172c3e2
Backdoor.TeamViewer
af766ba5f46115470242fa6033f4f4ba85c82b6d5a001ebfee8482e51d793e1d
Backdoor.TeamViewer
c02e920086d41efee570ff2aa367640d63394f1ef86bffb1ced03aafa9bebf4b
Backdoor.TeamViewer
ea53fa048fd00bb4b981d9556a824c39e405ec127ae052beadd688fdd66c5c0e
Backdoor.TeamViewer
ed586b013461f61285fafe5bc25912416167eb51d78b3a181c9e81e3d5c17436
Backdoor.TeamViewer
+ 815 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  7/10
Tags:
discovery
Link:
https://tria.ge/reports/230905-bxdfwscd4t/
Behaviour
Runs net.exe
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Drops file in Program Files directory
Checks installed software on the system
Executes dropped EXE
Loads dropped DLL
Unexpected DNS network traffic destination
Unpacked files
SH256 hash:
aa2eb39f5b7f863d566b76fae53e51d33630b294bd231e6ca9d3236f1f1da76f
MD5 hash:
8611bcd1d33b9f0d77bc6331858c6fbd
SHA1 hash:
b0131d22b341aeb9fee1d7584589a7ff19dc27dd
Link:
https://www.unpac.me/results/08c185df-3411-4881-96a9-6b59396e79b9/
SH256 hash:
99a10d31fd556f33be50ffd3011cee343659254eca3c693a9f660e19781a0d16
MD5 hash:
e972a34785517cab42f37f578c1cfcf5
SHA1 hash:
daab84229f12cd77a9b94ad046f374b4f0733216
Link:
https://www.unpac.me/results/08c185df-3411-4881-96a9-6b59396e79b9/
SH256 hash:
357be77ea4fe023dfc7a5b17a8b8e1d688321e8e2f8647cbb7814a4310a82f1d
MD5 hash:
bca5e4b8abd0537f6c3665941f21aa75
SHA1 hash:
d8b4f17d2eb5cc448df92d776a9306e576b54ff0
Link:
https://www.unpac.me/results/08c185df-3411-4881-96a9-6b59396e79b9/
SH256 hash:
3722e0f21e0e0acae40cc9d1bde058c2863cffbec2f8f80ca977986bf5eed690
MD5 hash:
91d371f6f831bfedbfbd4948ff4b17ca
SHA1 hash:
ae65953ef0af254686642442ad6576fb0d1fbfd0
Link:
https://www.unpac.me/results/08c185df-3411-4881-96a9-6b59396e79b9/
SH256 hash:
37f72d7cc30ac6952775a5972e510e0f2e0163b11ac7dea1e4dc0449dd8e633a
MD5 hash:
eaf2482f308de7dec8e73a0f92f2e1cf
SHA1 hash:
ba5ac15491d919d5b4ecc07b345e45336700bb45
Link:
https://www.unpac.me/results/08c185df-3411-4881-96a9-6b59396e79b9/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/37f72d7cc30ac6952775a5972e510e0f2e0163b11ac7dea1e4dc0449dd8e633a

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:shellcode
Create hunting rule
Author:nex
Description:Matched shellcode byte patterns

File information

The table below shows additional information about this malware sample such as delivery method and external references.

  
Dropped by
PrivateLoader
  
Delivery method
Distributed via drive-by
Cape
Cape
https://www.capesandbox.com/analysis/446180/

Comments