MalwareBazaar Database
You are currently viewing the MalwareBazaar entry for SHA256 38161de5bca7cef0ff24bf693f500bcabf1583c2e1d0ed40d85e40a8b6d2cb4d. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.
Database Entry
Backdoor.TeamViewer
Vendor detections: 11
| SHA256 hash: | 38161de5bca7cef0ff24bf693f500bcabf1583c2e1d0ed40d85e40a8b6d2cb4d |
|---|---|
| SHA3-384 hash: | 7997798d2c947c1f3fe05bd1b2ab3c1cc6fe8e7154aa0d74c1c686bd961d52d0ccc050f6669df400603d9de597cd64fe |
| SHA1 hash: | a6f2cb78c889fc80c30dec2b1b020962a90e1358 |
| MD5 hash: | 562434b2409fd9e3d36724d4c941df0a |
| humanhash: | whiskey-oklahoma-lemon-mirror |
| File name: | set17-1.exe |
| Download: | download sample |
| Signature | Backdoor.TeamViewer |
| File size: | 1'289'655 bytes |
| First seen: | 2023-09-06 10:40:48 UTC |
| Last seen: | Never |
| File type: |  exe |
| MIME type: | application/x-dosexec |
| imphash | 80417b621299e3e1de617305557a3c68 (48 x GCleaner, 44 x Backdoor.TeamViewer, 31 x Socks5Systemz) |
| ssdeep | 24576:iI39d60VdpY4gTRgbmJJ8Ap9W5LYIqr8es0BI2Qo82BMsugWCF8mU7bJDmtVhgex:i6dD8RSmo69W5EIqQes0LMUugWekmtPH |
| Threatray | 1'028 similar samples on MalwareBazaar |
| TLSH | T14A5533039962D5F8E23055F42D960B4CA726BE37347A454C3BDD2EAB7F2F1E81148B98 |
| TrID | 50.8% (.EXE) Win32 Executable PowerBASIC/Win 9.x (148303/79/28) 37.6% (.EXE) Inno Setup installer (109740/4/30) 4.8% (.EXE) Win32 Executable Delphi generic (14182/79/4) 2.2% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2) 1.5% (.EXE) Win32 Executable (generic) (4505/5/1) |
| File icon (PE): |  |
| dhash icon | b298acbab2ca7a72 (2'327 x GCleaner, 1'631 x Socks5Systemz, 67 x RedLineStealer) |
| Reporter | Anonymous |
| Tags: | Backdoor.TeamViewer exe |
Intelligence
File Origin
# of uploads :
1
# of downloads :
284
Origin country :
DEVendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
set17-1.exe
Verdict:
Malicious activity
Analysis date:
2023-09-06 10:43:52 UTC
Tags:
installer
Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Detection(s):
Result
Verdict:
Malware
Maliciousness:
Behaviour
Searching for the window
Creating a file in the Program Files subdirectories
Moving a file to the Program Files subdirectory
Launching the process to interact with network services
Modifying a system file
Launching a process
Creating a file
Creating a service
Sending a custom TCP request
Creating a file in the %temp% subdirectories
Creating a window
Creating a process from a recently created file
Сreating synchronization primitives
Enabling autorun for a service
Gathering data
Verdict:
Suspicious
Threat level:
5/10
Confidence:
100%
Tags:
control greyware installer lolbin overlay packed packed shell32
Verdict:
Malicious
Labled as:
Trojan/Evo
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Verdict:
Malicious
Result
Threat name:
n/a
Detection:
malicious
Classification:
evad
Score:
88 / 100
Signature
Antivirus detection for URL or domain
Contains functionality to infect the boot sector
Detected unpacking (changes PE section rights)
Detected unpacking (overwrites its own PE header)
Found API chain indicative of debugger detection
Found stalling execution ending in API Sleep call
Machine Learning detection for dropped file
Snort IDS alert for network traffic
Behaviour
Behavior Graph:
Threat name:
Win32.Trojan.Synder
Status:
Malicious
First seen:
2023-09-06 10:41:06 UTC
File Type:
PE (Exe)
Extracted files:
5
AV detection:
11 of 24 (45.83%)
Threat level:
5/5
Detection(s):
Suspicious file
Verdict:
malicious
Similar samples:
+ 1'018 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
7/10
Tags:
discovery
Behaviour
Runs net.exe
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Drops file in Program Files directory
Checks installed software on the system
Executes dropped EXE
Loads dropped DLL
Unexpected DNS network traffic destination
Unpacked files
SH256 hash:
fb25535c90951feb228de44d9984b96c2ee6c5bd2ac83d2a1f4caeb21953a433
MD5 hash:
0409103f1a4b7c9969a822bb4ffb9817
SHA1 hash:
bed1134121545bd8f2cd370757850770b3be5240
SH256 hash:
40a40b7ba6261cde0f4709e41f5a066c650aa82f6fb5e5896b3ae5df6c59c8e9
MD5 hash:
253f4571e5be614d0d9944df4b88c9f9
SHA1 hash:
28b3860e14ac279577d5099a732f352a44c3c75e
SH256 hash:
23ef2e9ace71f0ab4b83508b2e2e3bf315b0f30b0221abad76971085ac54401b
MD5 hash:
a8473513be2d7b5604df3612033e8745
SHA1 hash:
1aac6a1236899c13934d15c83286d5f1cca0f1e3
SH256 hash:
38161de5bca7cef0ff24bf693f500bcabf1583c2e1d0ed40d85e40a8b6d2cb4d
MD5 hash:
562434b2409fd9e3d36724d4c941df0a
SHA1 hash:
a6f2cb78c889fc80c30dec2b1b020962a90e1358
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
0.89
YARA Signatures
MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.
| Rule name: | shellcode |
|---|---|
| Author: | nex |
| Description: | Matched shellcode byte patterns |
File information
The table below shows additional information about this malware sample such as delivery method and external references.
Web download
exe 38161de5bca7cef0ff24bf693f500bcabf1583c2e1d0ed40d85e40a8b6d2cb4d
(this sample)
Delivery method
Distributed via web download
Comments
Login required
You need to login to in order to write a comment. Login with your abuse.ch account.