jaffacakes118_Trojan-Spy[.]Win32[.]TeamSpy[.]cs[.]6b55f40d7bd1790b0557347ea10e5d4c

General

Target
jaffacakes118_Trojan-Spy.Win32.TeamSpy.cs.6b55f40d7bd1790b0557347ea10e5d4c
Size 9.0MB
Sample261018-23wgrsty3p
SHA256 bdd1f56547ba522f87e7709ec3681c4bdeb99eaf770d368971e4b648ddc502c3
MD5 6b55f40d7bd1790b0557347ea10e5d4c
SHA1 3582aeb40aa80ddc010f6b9f716a10c7a362c397
SHA512 5989ff33c15ffc9c859525e3532ac76eab17688c5f3d536a3be7370146005436bf9a021d740a1d5bf59b07e8facea539a4e1ea2b9d468543d7609323b7d6ce52
SSDEEP 49152:XC2lJmXbj5DIwbQea1LPEyK7r385JD3d6cIWh:XzlkbFDVrQMyOr3S3d6cLh
TLSH
T140961203B293C072D49501B505658BBA4F3ABC319775D0FBAFD13AAA9D703E19B3634A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
jaffacakes118_Trojan-Spy.Win32.TeamSpy.cs.6b55f40d7bd1790b0557347ea10e5d4c

File Explorer

jaffacakes118_Trojan-Spy.Win32.TeamSpy.cs.6b55f40d7bd1790b0557347ea10e5d4c

.exe 9.0MB

jaffacakes118_Trojan-Spy.Win32.TeamSpy.cs.6b55f40d7bd1790b0557347ea10e5d4c

IMPHASH 1ff847646487d56f85778df99ff3728a
SHA256 bdd1f56547ba522f87e7709ec3681c4bdeb99eaf770d368971e4b648ddc502c3
MD5 6b55f40d7bd1790b0557347ea10e5d4c
SHA1 3582aeb40aa80ddc010f6b9f716a10c7a362c397
SHA512 5989ff33c15ffc9c859525e3532ac76eab17688c5f3d536a3be7370146005436bf9a021d740a1d5bf59b07e8facea539a4e1ea2b9d468543d7609323b7d6ce52
SSDEEP 49152:XC2lJmXbj5DIwbQea1LPEyK7r385JD3d6cIWh:XzlkbFDVrQMyOr3S3d6cLh
TLSH
T140961203B293C072D49501B505658BBA4F3ABC319775D0FBAFD13AAA9D703E19B3634A
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

1

Major OS version

5

Entry point

10721

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

_lclose GetModuleFileNameA _lread _llseek _lopen _lwrite _lcreat CreateDirectoryA SetCurrentDirectoryA lstrcatA FreeLibrary GetProcAddress LoadLibraryA GetDiskFreeSpaceA GetFileAttributesA RemoveDirectoryA DeleteFileA lstrlenA GetCurrentDirectoryA CloseHandle GetExitCodeProcess GetLastError LocalFree GetCurrentProcess MoveFileExA Sleep GetStringTypeW MultiByteToWideChar LCMapStringW HeapReAlloc RtlUnwind HeapSize lstrcpyA GetTempPathA CompareStringA IsValidCodePage GetOEMCP GetModuleHandleW ExitProcess DecodePointer HeapFree HeapAlloc GetCommandLineA HeapSetInformation GetStartupInfoW InitializeCriticalSectionAndSpinCount DeleteCriticalSection LeaveCriticalSection EnterCriticalSection EncodePointer LoadLibraryW UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent TerminateProcess TlsAlloc TlsGetValue TlsSetValue TlsFree InterlockedIncrement SetLastError GetCurrentThreadId InterlockedDecrement WriteFile GetStdHandle GetModuleFileNameW IsProcessorFeaturePresent HeapCreate FreeEnvironmentStringsW WideCharToMultiByte GetEnvironmentStringsW SetHandleCount GetFileType QueryPerformanceCounter GetTickCount GetCurrentProcessId GetSystemTimeAsFileTime GetCPInfo GetACP

user32

TranslateMessage DispatchMessageA PeekMessageA wsprintfA LoadCursorA SetCursor MessageBoxA MsgWaitForMultipleObjects

advapi32

GetTokenInformation OpenProcessToken

shell32

ShellExecuteExA

Sharing