MalwareBazaar Database
You are currently viewing the MalwareBazaar entry for SHA256 427b5d1b32a8e17b94097a085094afcf86e857dcc8db0fd0b4bf7c50e6f3f349. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.
Database Entry
TeamBot
Vendor detections: 19
| SHA256 hash: | 427b5d1b32a8e17b94097a085094afcf86e857dcc8db0fd0b4bf7c50e6f3f349 |
|---|---|
| SHA3-384 hash: | a3aeab450d0888da263dbb7d2c915f8111e394125da07417af3419f0181801814844471c78edf0748e7b59befff8df8f |
| SHA1 hash: | 1122686ab765417956748bbbf322e700d222cbdf |
| MD5 hash: | bd4889f68da70787b42a75a5d109eec5 |
| humanhash: | magazine-football-cold-mexico |
| File name: | Trojan-Spy.Win32.Stealer.aawf-427b5d1b32a8e17.exe |
| Download: | download sample |
| Signature | TeamBot |
| File size: | 8'118'361 bytes |
| First seen: | 2023-06-26 04:10:13 UTC |
| Last seen: | Never |
| File type: | |
| MIME type: | application/x-dosexec |
| imphash | fcf1390e9ce472c7270447fc5c61a0c1 (863 x DCRat, 118 x NanoCore, 94 x njrat) |
| ssdeep | 196608:PEpCOl85WKOqxgiFs/VGwgeYlRAhr9m+EkxE5YpZr:hOO5WTDMEAKFhxE5Or |
| TLSH | T13086331236429171D1F02D34187BA754563DB8044AD9BEDAB3E489ECA8F2CE1E631EF7 |
| TrID | 91.0% (.EXE) WinRAR Self Extracting archive (4.x-5.x) (265042/9/39) 3.6% (.EXE) Win64 Executable (generic) (10523/12/4) 1.7% (.EXE) Win16 NE executable (generic) (5038/12/1) 1.5% (.EXE) Win32 Executable (generic) (4505/5/1) 0.6% (.EXE) OS/2 Executable (generic) (2029/13) |
| File icon (PE): | |
| dhash icon | f0cccacaece4e0f0 (12 x RedLineStealer, 2 x GCleaner, 2 x RaccoonStealer) |
| Reporter | |
| Tags: | exe TeamBot |
Intelligence
File Origin
NLVendor Threat Intelligence
Result
Behaviour
Result
Behaviour
Result
Details
Result
Signature
Behaviour
Result
Behaviour
Malware Config
http://www.iyiqian.com/
http://www.xxhufdc.top/
http://www.uefhkice.xyz/
http://www.fcektsy.top/
http://37.0.10.214/proxies.txt
http://37.0.10.244/server.txt
pastebin.com/raw/A7dSG1te
http://wfsdragon.ru/api/setStats.php
31.210.20.251
http://91.241.19.125/pub.php?pub=one
http://sarfoods.com/index.php
45.9.20.20:13441
http://varmisende.com/upload/
http://fernandomayol.com/upload/
http://nextlytm.com/upload/
http://people4jan.com/upload/
http://asfaltwerk.com/upload/
Unpacked files
YARA Signatures
MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.
| Rule name: | BitcoinAddress |
|---|---|
| Author: | Didier Stevens (@DidierStevens) |
| Description: | Contains a valid Bitcoin address |
| Rule name: | command_and_control |
|---|---|
| Author: | CD_R0M_ |
| Description: | This rule searches for common strings found by malware using C2. Based on a sample used by a Ransomware group |
| Rule name: | crime_ZZ_botnet_aicm |
|---|---|
| Author: | imp0rtp3 |
| Description: | DDoS Golang Botnet sample for linux called 'aicm' |
| Reference: | https://twitter.com/IntezerLabs/status/1401869234511175683 |
| Rule name: | Disable_Defender |
|---|---|
| Author: | iam-py-test |
| Description: | Detect files disabling or modifying Windows Defender, Windows Firewall, or Microsoft Smartscreen |
| Rule name: | fbrobot_bin |
|---|---|
| Author: | James_inthe_box |
| Description: | fbrobot stealer |
| Reference: | https://app.any.run/tasks/317642cd-924b-4fe4-ba97-0c648f89c7a0 |
| Rule name: | fbrobot_mem |
|---|---|
| Author: | James_inthe_box |
| Description: | fbrobot stealer |
| Reference: | https://app.any.run/tasks/317642cd-924b-4fe4-ba97-0c648f89c7a0 |
| Rule name: | Glupteba |
|---|
| Rule name: | GoBinTest |
|---|
| Rule name: | golang |
|---|
| Rule name: | Golangmalware |
|---|---|
| Author: | Dhanunjaya |
| Description: | Malware in Golang |
| Rule name: | golang_binary_string |
|---|---|
| Description: | Golang strings present |
| Rule name: | HiveRansomware |
|---|---|
| Author: | Dhanunjaya |
| Description: | Yara Rule To Detect Hive V4 Ransomware |
| Rule name: | identity_golang |
|---|---|
| Author: | Eric Yocam |
| Description: | find Golang malware |
| Rule name: | INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA |
|---|---|
| Author: | ditekSHen |
| Description: | Detects Windows executables referencing non-Windows User-Agents |
| Rule name: | INDICATOR_SUSPICIOUS_EXE_RawGitHub_URL |
|---|---|
| Author: | ditekSHen |
| Description: | Detects executables containing URLs to raw contents of a Github gist |
| Rule name: | INDICATOR_SUSPICIOUS_EXE_References_CryptoWallets |
|---|---|
| Author: | ditekSHen |
| Description: | Detects executables referencing many cryptocurrency mining wallets or apps. Observed in information stealers |
| Rule name: | INDICATOR_SUSPICIOUS_EXE_TooManyWindowsUA |
|---|---|
| Author: | ditekSHen |
| Description: | Detects executables referencing many varying, potentially fake Windows User-Agents |
| Rule name: | MALWARE_Win_RedLine |
|---|---|
| Author: | ditekSHen |
| Description: | Detects RedLine infostealer |
| Rule name: | MAL_Malware_Imphash_Mar23_1 |
|---|---|
| Author: | Arnim Rupp |
| Description: | Detects malware by known bad imphash or rich_pe_header_hash |
| Reference: | https://yaraify.abuse.ch/statistics/ |
| Rule name: | meth_get_eip |
|---|---|
| Author: | Willi Ballenthin |
| Rule name: | meth_peb_parsing |
|---|---|
| Author: | Willi Ballenthin |
| Rule name: | meth_stackstrings |
|---|---|
| Author: | Willi Ballenthin |
| Rule name: | PE_Potentially_Signed_Digital_Certificate |
|---|---|
| Author: | albertzsigovits |
| Rule name: | SelfExtractingRAR |
|---|---|
| Author: | Xavier Mertens |
| Description: | Detects an SFX archive with automatic script execution |
| Rule name: | UroburosVirtualBoxDriver |
|---|
| Rule name: | Windows_Trojan_Glupteba_4669dcd6 |
|---|---|
| Author: | Elastic Security |
| Rule name: | Windows_Trojan_Glupteba_70557305 |
|---|---|
| Author: | Elastic Security |
| Rule name: | Windows_Trojan_Metasploit_7bc0f998 |
|---|---|
| Description: | Identifies the API address lookup function leverage by metasploit shellcode |
| Rule name: | Windows_Trojan_Metasploit_a6e956c9 |
|---|---|
| Description: | Identifies the API address lookup function leverage by metasploit shellcode |
| Rule name: | Windows_Trojan_Metasploit_c9773203 |
|---|---|
| Description: | Identifies the 64 bit API hashing function used by Metasploit. This has been re-used by many other malware families. |
| Reference: | https://github.com/rapid7/metasploit-framework/blob/04e8752b9b74cbaad7cb0ea6129c90e3172580a2/external/source/shellcode/windows/x64/src/block/block_api.asm |
| Rule name: | Windows_Trojan_Metasploit_f7f826b4 |
|---|---|
| Author: | Elastic Security |
| Description: | Identifies metasploit kernel->user shellcode. Likely used in ETERNALBLUE and BlueKeep exploits. |
| Rule name: | Windows_Trojan_Smokeloader_3687686f |
|---|---|
| Author: | Elastic Security |
| Rule name: | win_ffdroider_w0 |
|---|---|
| Author: | Johannes Bader @viql |
| Description: | detects FFDroider |
| Rule name: | yara_template |
|---|
File information
The table below shows additional information about this malware sample such as delivery method and external references.
Comments
Login required
You need to login to in order to write a comment. Login with your abuse.ch account.