MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 9f17bc1d692c8fa0305756444521f1f664d133e64b7bf058f93ae1e24a418264. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


TeamBot


Vendor detections: 16


Intelligence 16 IOCs YARA 6 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 9f17bc1d692c8fa0305756444521f1f664d133e64b7bf058f93ae1e24a418264
SHA3-384 hash: 545ff811b11e4d58216bc8b3d508d5b77763d8c8988d4c2f2f71e61b5cb953e0d9373476dab10858c18ade8f947db7ef
SHA1 hash: 3e6de2aae3aefd649d267c4ee43f9b0bce0db667
MD5 hash: dd2193abb2f82d60a7c2bf612c7ad6a0
humanhash: fifteen-black-wisconsin-crazy
File name:dd2193abb2f82d60a7c2bf612c7ad6a0.exe
Download: download sample
Signature TeamBot
Create hunting rule
File size:801'792 bytes
First seen:2022-12-07 11:25:14 UTC
Last seen:2022-12-07 12:50:10 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash 0e07727b7aa043411d3cef91d410684c (17 x Amadey, 3 x Smoke Loader, 2 x TeamBot)
ssdeep 12288:pYQVwkrDIJma2aFeWVknOi8JBG2pI1AfDEQLyCcus:pYgwGL7vcJ16CEj
Threatray 3'841 similar samples on MalwareBazaar
TLSH T1B20512313682C4B2C96726325965FAE16FA9FC73D427D447B7943F6E2E307C056A220E
TrID 47.3% (.EXE) Win32 Executable MS Visual C++ (generic) (31206/45/13)
15.9% (.EXE) Win64 Executable (generic) (10523/12/4)
9.9% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
7.6% (.EXE) Win16 NE executable (generic) (5038/12/1)
6.8% (.EXE) Win32 Executable (generic) (4505/5/1)
File icon (PE):PE icon
dhash icon 9a9acafecee6eae6 (12 x Smoke Loader, 10 x Amadey, 2 x ArkeiStealer)
Reporter abuse_ch
Tags:exe TeamBot


Avatar
abuse_ch
TeamBot C2:
http://abibiall.com/test1/get.php

Intelligence

File Origin
# of uploads :
2
# of downloads :
184
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
stop
Create hunting rule
ID:
1
File name:
dd2193abb2f82d60a7c2bf612c7ad6a0.exe
Verdict:
Malicious activity
Analysis date:
2022-12-07 11:27:36 UTC
Tags:
trojan loader ransomware stop stealer vidar
Link:
https://app.any.run/tasks/06720688-a81c-4721-b7d5-3e3a3c008dc8

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
STOP
Create hunting rule
Link:
https://www.capesandbox.com/analysis/343820/
Detection(s):
SecuriteInfo.com.Win32.RansomX-gen.29448.17305.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
Unauthorized injection to a recently created process
Sending an HTTP GET request
Creating a file
Launching a process
Creating a process with a hidden window
Adding an access-denied ACE
Сreating synchronization primitives
Deleting a recently created file
DNS request
Searching for synchronization primitives
Query of malicious DNS domain
Sending a TCP request to an infection source
Enabling autorun with the standard Software\Microsoft\Windows\CurrentVersion\Run registry branch
Enabling autorun by creating a file
Sending an HTTP GET request to an infection source
Verdict:
Suspicious
Threat level:
  5/10
Confidence:
100%
Tags:
greyware packed
Link:
https://www.filescan.io/uploads/6390784f0a5c344f30c14f7d/reports/36b60637-8df5-4beb-84cc-5f605dad9d96/overview
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
STOP Ransomware
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/e43dee49-62d6-46bf-8f7d-2d0ad5e6cdcb
Result
Threat name:
Babuk, Clipboard Hijacker, Djvu, HTMLPhi
Create hunting rule
Detection:
malicious
Classification:
rans.spre.phis.troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1129818
Signature
Antivirus detection for dropped file
Antivirus detection for URL or domain
C2 URLs / IPs found in malware configuration
Contains functionality to inject code into remote processes
Detected unpacking (creates a PE file in dynamic memory)
Found ransom note / readme
Infects executable files (exe, dll, sys, html)
Injects a PE file into a foreign processes
Machine Learning detection for dropped file
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
Modifies existing user documents (likely ransomware behavior)
Multi AV Scanner detection for domain / URL
Multi AV Scanner detection for dropped file
Snort IDS alert for network traffic
Tries to harvest and steal browser information (history, passwords, etc)
Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)
Tries to steal Crypto Currency Wallets
Uses schtasks.exe or at.exe to add and modify task schedules
Writes a notice file (html or txt) to demand a ransom
Writes many files with high entropy
Yara detected Babuk Ransomware
Yara detected Clipboard Hijacker
Yara detected Djvu Ransomware
Yara detected HtmlPhish10
Yara detected Vidar stealer
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 762542 Sample: nZmXxXPp9p.exe Startdate: 07/12/2022 Architecture: WINDOWS Score: 100 95 Snort IDS alert for network traffic 2->95 97 Multi AV Scanner detection for domain / URL 2->97 99 Malicious sample detected (through community Yara rule) 2->99 101 12 other signatures 2->101 12 nZmXxXPp9p.exe 2->12         started        15 nZmXxXPp9p.exe 2->15         started        17 nZmXxXPp9p.exe 2->17         started        19 2 other processes 2->19 process3 signatures4 113 Writes a notice file (html or txt) to demand a ransom 12->113 115 Contains functionality to inject code into remote processes 12->115 117 Writes many files with high entropy 12->117 21 nZmXxXPp9p.exe 1 17 12->21         started        119 Injects a PE file into a foreign processes 15->119 25 nZmXxXPp9p.exe 12 15->25         started        27 nZmXxXPp9p.exe 17->27         started        29 nZmXxXPp9p.exe 19->29         started        31 schtasks.exe 19->31         started        process5 dnsIp6 85 api.2ip.ua 162.0.217.254, 443, 49691, 49692 ACPCA Canada 21->85 69 C:\Users\user\AppData\...\nZmXxXPp9p.exe, PE32 21->69 dropped 71 C:\Users\...\nZmXxXPp9p.exe:Zone.Identifier, ASCII 21->71 dropped 33 nZmXxXPp9p.exe 21->33         started        36 icacls.exe 21->36         started        38 conhost.exe 31->38         started        file7 process8 signatures9 93 Injects a PE file into a foreign processes 33->93 40 nZmXxXPp9p.exe 1 25 33->40         started        process10 dnsIp11 87 abibiall.com 175.119.10.231, 49694, 49700, 80 SKB-ASSKBroadbandCoLtdKR Korea Republic of 40->87 89 uaery.top 200.46.66.71, 49693, 80 CableOndaPA Panama 40->89 91 2 other IPs or domains 40->91 73 C:\Users\user\AppData\Local\...\build3[1].exe, PE32 40->73 dropped 75 C:\Users\user\AppData\Local\...\build2[1].exe, PE32 40->75 dropped 77 C:\_readme.txt, ASCII 40->77 dropped 79 223 other malicious files 40->79 dropped 109 Infects executable files (exe, dll, sys, html) 40->109 111 Modifies existing user documents (likely ransomware behavior) 40->111 45 build2.exe 40->45         started        48 build3.exe 40->48         started        file12 signatures13 process14 file15 121 Detected unpacking (creates a PE file in dynamic memory) 45->121 123 Injects a PE file into a foreign processes 45->123 51 build2.exe 45->51         started        67 C:\Users\user\AppData\Roaming\...\mstsca.exe, PE32 48->67 dropped 125 Uses schtasks.exe or at.exe to add and modify task schedules 48->125 55 schtasks.exe 48->55         started        signatures16 process17 dnsIp18 81 t.me 149.154.167.99, 443, 49702 TELEGRAMRU United Kingdom 51->81 83 95.216.205.133, 49704, 80 HETZNER-ASDE Germany 51->83 103 Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc) 51->103 105 Tries to harvest and steal browser information (history, passwords, etc) 51->105 107 Tries to steal Crypto Currency Wallets 51->107 57 cmd.exe 51->57         started        59 conhost.exe 55->59         started        61 conhost.exe 55->61         started        signatures19 process20 process21 63 conhost.exe 57->63         started        65 timeout.exe 57->65         started       
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/9f17bc1d692c8fa0305756444521f1f664d133e64b7bf058f93ae1e24a418264/
Threat name:
Win32.Trojan.MintZard
Create hunting rule
Status:
Malicious
First seen:
2022-12-07 11:26:10 UTC
File Type:
PE (Exe)
Extracted files:
65
AV detection:
20 of 26 (76.92%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=t4l3yhljfsh2amcxkzcekipr6zsncm7gjn57awhzhlq6essbqjsa._file
Verdict:
malicious
Similar samples:
00ee1a5396b9c326f5e1bf4bdb03dc60c5ecf65d3e0ec53cd471886f400c1d9b
TeamBot
06274ae644ad962ebbab5bb3c52c930e5390b88472e00117ff3abc438c5ea388
TeamBot
3d61799098595a74aa43cc391c11beea14044a4ccbe27dfcff887ed5a74544f4
TeamBot
43f822b1220756e8484429635c2de1d11565e1c1de484c735dde760b06033867
TeamBot
5aad6ebccf994b06ae04f81acb19cbf976cea52e91671b5375c9c5d37dbb7098
TeamBot
6b2e3ed5c3e90f211fd187a2a010054d4ce49d3d1a3cdc03468d484f8e4adadb
TeamBot
a5c5875892fcf16b14b95f13bc01d686f6127877cc1562721a8182db00c92912
TeamBot
b990ed5485491482b2c8ee144a2fa5998aaa8fc5575b0ed740e85c40d750721b
TeamBot
c867502d48b3716cd863de5e8e0047e3d829d2a2db9d98750ebfc28d1585b641
TeamBot
+ 3'831 additional samples on MalwareBazaar
Result
Malware family:
vidar
Create hunting rule
Score:
  10/10
Tags:
family:djvu family:vidar botnet:517 discovery persistence ransomware spyware stealer
Link:
https://tria.ge/reports/221207-njv51afc5s/
Behaviour
Checks processor information in registry
Creates scheduled task(s)
Delays execution with timeout.exe
Modifies system certificate store
Suspicious behavior: EnumeratesProcesses
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Suspicious use of SetThreadContext
Accesses 2FA software files, possible credential harvesting
Accesses cryptocurrency files/wallets, possible credential harvesting
Adds Run key to start application
Checks installed software on the system
Looks up external IP address via web service
Checks computer location settings
Loads dropped DLL
Modifies file permissions
Reads user/profile data of web browsers
Downloads MZ/PE file
Executes dropped EXE
Detected Djvu ransomware
Djvu Ransomware
Vidar
Malware Config
C2 Extraction:
http://abibiall.com/test1/get.php
https://t.me/dishasta
https://steamcommunity.com/profiles/76561199441933804
Verdict:
Informative
Tags:
n/a
YARA:
n/a
Link:
https://app.threat.zone/submission/d2bb0702-7f9f-447a-ac82-ec4fe4a4d9eb
Unpacked files
SH256 hash:
be01e7adefbf6b3eaa9f26ef8132ab6ea58042ef464bd0c17ee1cbddec1173b4
MD5 hash:
17aacf9f4c158a0206e71e6216248139
SHA1 hash:
5a1ab595b4412c4229fb86482f9dff037f41ebcf
Detections:
win_stop_auto
Create hunting rule
win_stop_auto
Create hunting rule
Link:
https://www.unpac.me/results/7e2bcea1-ae36-4e49-b812-b8a8437e09bf/
Parent samples :
00ee1a5396b9c326f5e1bf4bdb03dc60c5ecf65d3e0ec53cd471886f400c1d9b
3d61799098595a74aa43cc391c11beea14044a4ccbe27dfcff887ed5a74544f4
c867502d48b3716cd863de5e8e0047e3d829d2a2db9d98750ebfc28d1585b641
9f17bc1d692c8fa0305756444521f1f664d133e64b7bf058f93ae1e24a418264
56d69865665bf33e1256eb0fa2cd50f596c9bbf8abe0cac09c41037a9d667a31
0f42167e3b9736a4e1c33e4d99255ac37963d96756ffa772885fbaa4c493a21a
dbab3a22dcc5927c28a4e3772b794bb559bdfca088216de8351ae21886587884
SH256 hash:
afbd0430803c191f75ea19839c9c9bf80908b76e221bab0ffbaba77d37717c5e
MD5 hash:
589b28a526af682ddfe3214d0c88f4fb
SHA1 hash:
b1eb5cbdf355d5cb7cbc340b3a3b48a4be32ad30
Detections:
win_stop_auto
Create hunting rule
Link:
https://www.unpac.me/results/7e2bcea1-ae36-4e49-b812-b8a8437e09bf/
SH256 hash:
a47e710d73516658533b78f5c3716105c43af3eb03a38711f1e71f84cd18be1f
MD5 hash:
7672262a3dadc16a05a398dc90b9ccc7
SHA1 hash:
7e7484f3c00767a72584f655721c84ed226f8614
Link:
https://www.unpac.me/results/7e2bcea1-ae36-4e49-b812-b8a8437e09bf/
SH256 hash:
c36dc029177efcc6d552cf216ec96a32b9bb3c3bd588f5a09850a68d6a0dfeda
MD5 hash:
2cc61b750e47d5f913089d9b299e7897
SHA1 hash:
6cd960d95f30bf87351aba840420518ab2db8c06
Link:
https://www.unpac.me/results/7e2bcea1-ae36-4e49-b812-b8a8437e09bf/
SH256 hash:
ba4fb5d4ab575d2acc70675132b3c845de51474542f9bfeb70a664bb1215ebf1
MD5 hash:
5dc0277d1042b2e5e53c1feb19bf5df5
SHA1 hash:
431c36d465b911f455952065050846d2c8279c29
Detections:
win_stop_auto
Create hunting rule
Link:
https://www.unpac.me/results/7e2bcea1-ae36-4e49-b812-b8a8437e09bf/
SH256 hash:
cb31899232addd5f577a562d205f460d4b5ea4c40c3878c3e128b00ea080174e
MD5 hash:
0438c1a5cf3bcdf5772fe082ca068273
SHA1 hash:
c4bf78760c8095b3212fcd39a097f4431e6793a1
Detections:
win_stop_auto
Create hunting rule
Link:
https://www.unpac.me/results/7e2bcea1-ae36-4e49-b812-b8a8437e09bf/
SH256 hash:
699ddecceef0ff09b74226829534fe33af97e54e25c9c80235e9743951cb142b
MD5 hash:
99c292692ac2fac652277b3b9f727857
SHA1 hash:
6965437c6893402347dcb25987da4697f2b5ada3
Link:
https://www.unpac.me/results/7e2bcea1-ae36-4e49-b812-b8a8437e09bf/
SH256 hash:
9f17bc1d692c8fa0305756444521f1f664d133e64b7bf058f93ae1e24a418264
MD5 hash:
dd2193abb2f82d60a7c2bf612c7ad6a0
SHA1 hash:
3e6de2aae3aefd649d267c4ee43f9b0bce0db667
Link:
https://www.unpac.me/results/7e2bcea1-ae36-4e49-b812-b8a8437e09bf/
Malware family:
STOP
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/9f17bc1d692c/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/9f17bc1d692c8fa0305756444521f1f664d133e64b7bf058f93ae1e24a418264

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:MALWARE_Win_STOP
Create hunting rule
Author:ditekSHen
Description:Detects STOP ransomware
Rule name:pdb_YARAify
Create hunting rule
Author:@wowabiy314
Description:PDB
Rule name:SUSP_XORed_URL_in_EXE
Create hunting rule
Author:Florian Roth
Description:Detects an XORed URL in an executable
Reference:https://twitter.com/stvemillertime/status/1237035794973560834
Rule name:SUSP_XORed_URL_in_EXE_RID2E46
Create hunting rule
Author:Florian Roth
Description:Detects an XORed URL in an executable
Reference:https://twitter.com/stvemillertime/status/1237035794973560834
Rule name:Windows_Ransomware_Stop_1e8d48ff
Create hunting rule
Author:Elastic Security
Rule name:win_stop_auto
Create hunting rule
Author:Felix Bilstein - yara-signator at cocacoding dot com
Description:Detects win.stop.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

TeamBot

Executable exe 9f17bc1d692c8fa0305756444521f1f664d133e64b7bf058f93ae1e24a418264

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/2393524/
  
Delivery method
Distributed via web download
Cape
Cape
https://www.capesandbox.com/analysis/343820/

Comments