MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 eb14b66b263d66a5f9c3388d6a1a8b140a459815a70de76b9f31052c7884f623. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Cambot


Vendor detections: 7


Intelligence 7 IOCs YARA 2 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: eb14b66b263d66a5f9c3388d6a1a8b140a459815a70de76b9f31052c7884f623
SHA3-384 hash: f5a3ae48c4fffad1ea554dcc553a498ef1ad95aec17e7997551c23435920fd6eb164b641ece88bb11abc5bf1a23c45cc
SHA1 hash: 0fe9cce5cb3ff1e8e49855620ec692aa6e1fa9de
MD5 hash: bba8d680e17b1003d7c49b5211168a9b
humanhash: wyoming-hydrogen-two-pennsylvania
File name:eb14b66b263d66a5f9c3388d6a1a8b140a459815a70de76b9f31052c7884f623
Download: download sample
Signature Cambot
Create hunting rule
File size:207'832 bytes
First seen:2020-07-06 07:14:07 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash 3e8ae3bc85823ef9afa9731fe8e9fda0 (11 x Cambot, 4 x BlackShades)
ssdeep 3072:3Hjk+0oLnWFnzBHv/xWFsg8WatFBGFVWPE5ac0pG/1z+QVMbg1NWGw:Xo/BHng5HaVG4G/1z+QVMbg10Gw
Threatray 278 similar samples on MalwareBazaar
TLSH 7914AE33B3D40A85E9AEDB713BA9C6F9662375187F23618A2108677D7C15E204C19B2F
Reporter JAMESWT_WT
Tags:Cambot

Intelligence

File Origin
# of uploads :
1
# of downloads :
97
Origin country :
n/a
Vendor Threat Intelligence
Detection:
Blackshadesrat
Create hunting rule
Link:
https://www.capesandbox.com/analysis/21088/
Detection(s):
Win.Trojan.Blackshades-6327385-1
Create hunting rule

Win.Trojan.VBGeneric-6735886-0
Create hunting rule

Win.Worm.Vobfus-7513439-0
Create hunting rule

Win.Worm.Vobfus-7541859-0
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
Creating a file in the %AppData% directory
Creating a file in the %temp% directory
DNS request
Sending an HTTP GET request
Moving of the original file
Enabling autorun with the standard Software\Microsoft\Windows\CurrentVersion\Run registry branch
Enabling autorun
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/eb14b66b263d66a5f9c3388d6a1a8b140a459815a70de76b9f31052c7884f623/
Threat name:
Win32.Worm.Cambot
Create hunting rule
Status:
Malicious
First seen:
2018-12-29 06:26:11 UTC
File Type:
PE (Exe)
Extracted files:
1
AV detection:
31 of 31 (100.00%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=5mklm2zghvtkl6odhcgwugulcqfelgavu4g6o247gecsy6ee6yrq._file
Verdict:
malicious
Similar samples:
13c555d2bc29bc384b7c496c0aefadfbe38d7b415e11c43bdbcfdf702062d1f3
Cambot
504cd8dcf16b6e6b55271ef9bcd8603916ec5f81fdeb0615e3c970954d50a7f0
Cambot
50d68559290556e9e3524e8aec940a98b4564b57cc2a60f79d4da9a7d1f8de46
Cambot
bb2faadcbc0d7c66a84bb763e34cc811194f21a2222541a62fd1c0d9d3ce6c42
Cambot
c882cc422e4039600b31e53e369f05b29dc9dd38cab76facef8a42adc8d326b3
Cambot
ddf6f04276c1d976e62e199e6c928fb7a3d7aaec455a1859f8d8f605c89ffc64
Cambot
e0c1fb97e28bc9944bc045ee772dd8da34a985a9e410764734eacdb35429cd1b
Cambot
ee126e4a18e0697b4bfa8e81c16c986ad8625f698f4abbfcb3100245d76cde9e
Cambot
ee258df3b6f2dce2898606ef5767b8a5127f50df389ca83559adf529dacdfe62
Cambot
fcb020fc827bf432792feef13068e8094ae0dd1f201fa398a360eecf6216630b
Cambot
+ 268 additional samples on MalwareBazaar
Result
Malware family:
vobfus
Create hunting rule
Score:
  10/10
Tags:
persistence worm family:vobfus
Link:
https://tria.ge/reports/200706-e1wpebdyhs/
Behaviour
Script User-Agent
Suspicious use of SetWindowsHookEx
Suspicious behavior: RenamesItself
Suspicious behavior: GetForegroundWindowSpam
Adds Run entry to start application
Adds Run entry to policy start application
Vobfus
Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:win_blackshades_w0
Create hunting rule
Author:Jean-Philippe Teissier / @Jipe_
Rule name:win_vobfus_auto
Create hunting rule
Author:Felix Bilstein - yara-signator at cocacoding dot com
Description:autogenerated rule brought to you by yara-signator

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/21088/

Comments