MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 ee126e4a18e0697b4bfa8e81c16c986ad8625f698f4abbfcb3100245d76cde9e. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Cambot


Vendor detections: 5


Intelligence 5 IOCs YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: ee126e4a18e0697b4bfa8e81c16c986ad8625f698f4abbfcb3100245d76cde9e
SHA3-384 hash: a471b94855d59fc018ce73e1cdc8aee0cd79c52db554efbc375da5295b7ec09cb2075de0cc17efc345535a629248d1a9
SHA1 hash: 748a01816a826ec02d1a7884cd3212ccaed1742d
MD5 hash: d14849a31ed6bd4c69ad227f635b2a93
humanhash: delta-triple-autumn-carbon
File name:ee126e4a18e0697b4bfa8e81c16c986ad8625f698f4abbfcb3100245d76cde9e
Download: download sample
Signature Cambot
Create hunting rule
File size:1'692'000 bytes
First seen:2020-06-10 12:14:24 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash 3e8ae3bc85823ef9afa9731fe8e9fda0 (11 x Cambot, 4 x BlackShades)
ssdeep 12288:4ZgaYiZgaYiZgaYzZgamZgaYiZgaYiZgaYzZgas:4ZgLiZgLiZgLzZgxZgLiZgLiZgLzZgF
Threatray 145 similar samples on MalwareBazaar
TLSH 2175AE23B3D50A45E9EEDB753BB9C6F9622375187F23618A210867BD7C11E204C16B2F
Reporter JAMESWT_WT
Tags:Cambot

Intelligence

File Origin
# of uploads :
1
# of downloads :
100
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Win.Trojan.Blackshades-6327385-1
Create hunting rule

Win.Trojan.VBGeneric-6735886-0
Create hunting rule

Win.Worm.Vobfus-7513439-0
Create hunting rule

Win.Worm.Vobfus-7541859-0
Create hunting rule

Gathering data
Threat name:
Win32.Worm.Cambot
Create hunting rule
Status:
Malicious
First seen:
2020-05-22 15:41:04 UTC
File Type:
PE (Exe)
Extracted files:
7
AV detection:
27 of 27 (100.00%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=5yjg4sqy4buxws72r2a4c3eynlmgex3jr5flx7ftcabelv3m32pa._file
Verdict:
malicious
Similar samples:
13c555d2bc29bc384b7c496c0aefadfbe38d7b415e11c43bdbcfdf702062d1f3
Cambot
504cd8dcf16b6e6b55271ef9bcd8603916ec5f81fdeb0615e3c970954d50a7f0
Cambot
50d68559290556e9e3524e8aec940a98b4564b57cc2a60f79d4da9a7d1f8de46
Cambot
bb2faadcbc0d7c66a84bb763e34cc811194f21a2222541a62fd1c0d9d3ce6c42
Cambot
c882cc422e4039600b31e53e369f05b29dc9dd38cab76facef8a42adc8d326b3
Cambot
ddf6f04276c1d976e62e199e6c928fb7a3d7aaec455a1859f8d8f605c89ffc64
Cambot
e0c1fb97e28bc9944bc045ee772dd8da34a985a9e410764734eacdb35429cd1b
Cambot
eb14b66b263d66a5f9c3388d6a1a8b140a459815a70de76b9f31052c7884f623
Cambot
ee258df3b6f2dce2898606ef5767b8a5127f50df389ca83559adf529dacdfe62
Cambot
fcb020fc827bf432792feef13068e8094ae0dd1f201fa398a360eecf6216630b
Cambot
+ 135 additional samples on MalwareBazaar
Result
Malware family:
vobfus
Create hunting rule
Score:
  10/10
Tags:
family:vobfus persistence worm
Link:
https://tria.ge/reports/201109-2e6qkerfw6/
Behaviour
Script User-Agent
Suspicious behavior: GetForegroundWindowSpam
Suspicious behavior: RenamesItself
Suspicious use of SetWindowsHookEx
Adds Run key to start application
Adds policy Run key to start application
Vobfus
Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:win_blackshades_w0
Create hunting rule
Author:Jean-Philippe Teissier / @Jipe_

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Comments