MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 8149ba1f710102ff2383263c9f80d5a7c06352ee3a24d1a7beb9d702dd423ec5. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

TeamBot

Vendor detections: 12

Intelligence 12 IOCs YARA 5 File information Comments

SHA256 hash:	8149ba1f710102ff2383263c9f80d5a7c06352ee3a24d1a7beb9d702dd423ec5
SHA3-384 hash:	d36128e028c9a1c1d984f746016a6835e7768093d8e173d8c715c131f6eb0955c2916242d31714335f731a1582de3578
SHA1 hash:	72e6253d78f53e123dd3f99a5d2aee225ad470c2
MD5 hash:	e481024a7f235afb0aa19d58cb390226
humanhash:	timing-sweet-lemon-queen
File name:	e481024a7f235afb0aa19d58cb390226.exe
Download:	download sample
Signature	TeamBot Create hunting rule
File size:	788'992 bytes
First seen:	2021-07-22 17:13:19 UTC
Last seen:	2021-07-22 17:50:44 UTC
File type:	exe
MIME type:	application/x-dosexec
imphash	7780eb9cc098185992365509d7637fd7 (4 x RaccoonStealer, 1 x DanaBot, 1 x TeamBot)
ssdeep	12288:jUyakPzwWyrEqc9tfIFLcwsKfAzfDqD9YW//g4ME2eORogvr56e62yhULhm2ld:wyjsJ76t6sJtW3F4KgvrDyqLz
Threatray	393 similar samples on MalwareBazaar
TLSH	T1AEF4125176C2ED72D2D14A3184DB83B42BBEFC2666AD498B664037DF7E30291527E312
dhash icon	48b9b2b0e8c18890 (4 x RaccoonStealer, 2 x RedLineStealer, 1 x DanaBot)
Reporter	abuse_ch
Tags:	exe TeamBot

Intelligence

File Origin

# of uploads :

# of downloads :

150

Origin country :

n/a

Vendor Threat Intelligence

Malware family:

n/a

ID:

File name:

e481024a7f235afb0aa19d58cb390226.exe

Verdict:

Suspicious activity

Analysis date:

2021-07-22 17:22:52 UTC

Tags:

n/a

Link:

https://app.any.run/tasks/8815c15b-43a7-4e0b-9c4f-bef0eb250389

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

Detection:

Vidar

Link:

https://www.capesandbox.com/analysis/173411/

Detection(s):

SecuriteInfo.com.Trojan.Packed2.43324.26599.7148.UNOFFICIAL

Result

Verdict:

MALICIOUS

Details

Windows PE Executable

Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.

Malware family:

STOP Ransomware

Verdict:

Malicious

Link:

https://analyze.intezer.com/analyses/a5c52630-f70a-4868-93cc-24dd8173e452

Result

Threat name:

Djvu

Detection:

malicious

Classification:

rans.evad

Score:

80 / 100

Link:

https://www.joesandbox.com/analysis/820332

Signature

Detected unpacking (changes PE section rights)

Detected unpacking (overwrites its own PE header)

Injects a PE file into a foreign processes

Machine Learning detection for sample

Multi AV Scanner detection for submitted file

Yara detected Djvu Ransomware

Behaviour

Behavior Graph:

Download SVG

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/8149ba1f710102ff2383263c9f80d5a7c06352ee3a24d1a7beb9d702dd423ec5/

Threat name:

Win32.Trojan.Fugrafa

Status:

Malicious

First seen:

2021-07-21 23:09:22 UTC

File Type:

PE (Exe)

Extracted files:

AV detection:

26 of 46 (56.52%)

Threat level:

5/5

Detection(s):

Malicious file

Link:

https://check.spamhaus.org/check/?searchterm=qfe3uh3raebp6i4dey6j7agvu7agguxohisndj56xhlqfxkch3cq._file

Verdict:

malicious

TeamBot

34ce0db0264cb552d28100353840f27bb546729685684bb80691e05afbfe2b26

TeamBot

4fc4936de4eb693ec57ae17e722c1c68e46afbc0c82f3c45d254c39571008f8b

TeamBot

bcba5928ffde896ba6925acda9a28f9236c5f11cf0e412d9f7e33b9fc8a69809

TeamBot

eaffdf51b17ef1b7b7bf01ab6e8c2dce61a3dbd875b368e06a6d3b95e100c6f1

TeamBot

f8b60e554ed303e2debe7422bb363dcc33ace171d02388bce2e8ab5ce5364f5d

TeamBot

ff9e059a789e94573fb32a918657d5c5c59b5395fab873cbcec7b1543435fe93

TeamBot

+ 383 additional samples on MalwareBazaar

Result

Malware family:

vidar

Score:

10/10

Tags:

family:vidar botnet:517 discovery persistence spyware stealer suricata

Link:

https://tria.ge/reports/210722-zmrfjbwfcx/

Behaviour

Checks processor information in registry

Delays execution with timeout.exe

Kills process with taskkill

Modifies system certificate store

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

Enumerates physical storage devices

Suspicious use of SetThreadContext

Accesses 2FA software files, possible credential harvesting

Accesses cryptocurrency files/wallets, possible credential harvesting

Adds Run key to start application

Checks installed software on the system

Looks up external IP address via web service

Loads dropped DLL

Modifies file permissions

Reads user/profile data of web browsers

Downloads MZ/PE file

Executes dropped EXE

Vidar Stealer

Vidar

suricata: ET MALWARE Potential Dridex.Maldoc Minimal Executable Request

suricata: ET MALWARE Suspicious Zipped Filename in Outbound POST Request (Passwords.txt)

suricata: ET MALWARE Vidar/Arkei Stealer Client Data Upload

suricata: ET MALWARE Vidar/Arkei/Megumin/Oski Stealer Data Exfil

Malware Config

C2 Extraction:

https://sslamlssa1.tumblr.com/

Unpacked files

SH256 hash:

607707c8132dcfad64ad037667bed63c8ea2805904db07d0adb550424130a39c

MD5 hash:

a42f9d8fb2cc8c71372f68a2ce058a06

SHA1 hash:

0cf04b56200ace1c58906df83c43245cd2521c34

Detections:

win_stop_auto

Link:

https://www.unpac.me/results/03e211f7-3a2f-4a02-92f0-83598be93ba2/

Parent samples :

a8c7303d13cc249ed8f9c159e76d9edbfb7dbf6249c663f8e8f413083e42582a
bafa7212a0a4b4b79e977cbd09e9a102a51a66a352e10366e748f0a1a90f0215
efd055ee7d3d09c7211dd6aceef64f42ff62d01edf0105d06d77d0b92411bedc
8149ba1f710102ff2383263c9f80d5a7c06352ee3a24d1a7beb9d702dd423ec5
78d30477d1d0c61b8f613acf41ca2bf33bd2cc45c4e1f102dd5900aa25dd3c35
4bf2dace8a23551a3cd374a14b68cef6185aa18f9148dac8bf77f19f734d3ad7
f5a484d6db0cfca71151e5870cde7b1711cbfa8dc0175140aee2c47c24595d27
331318ad73d13c8c2e3fbb0d56c5a493722f42eeda70c0b8e375abe035a6b54f
363189b59e6f4f6ced2fd81ca31ef1299ac9989288f51162bd6c03fdb4fd5a50

SH256 hash:

8149ba1f710102ff2383263c9f80d5a7c06352ee3a24d1a7beb9d702dd423ec5

MD5 hash:

e481024a7f235afb0aa19d58cb390226

SHA1 hash:

72e6253d78f53e123dd3f99a5d2aee225ad470c2

Link:

https://www.unpac.me/results/03e211f7-3a2f-4a02-92f0-83598be93ba2/

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/8149ba1f710102ff2383263c9f80d5a7c06352ee3a24d1a7beb9d702dd423ec5

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	INDICATOR_SUSPICOIUS_EXE_WindDefender_AntiEmaulation Create hunting rule
Author:	ditekSHen
Description:	Detects executables containing potential Windows Defender anti-emulation checks

Rule name:	MALWARE_Win_STOP Create hunting rule
Author:	ditekSHen
Description:	Detects STOP ransomware

Rule name:	MALWARE_Win_Vidar Create hunting rule
Author:	ditekSHen
Description:	Detects Vidar / ArkeiStealer

Rule name:	SUSP_XORed_URL_in_EXE Create hunting rule
Author:	Florian Roth
Description:	Detects an XORed URL in an executable
Reference:	https://twitter.com/stvemillertime/status/1237035794973560834