In-depth analysis of the new Team9 malware family
Tags
cmtmf-attack-pattern: Process Injection
country: Russia
attack-pattern: Data Dns - T1071.004 Dns - T1590.002 Domains - T1583.001 Domains - T1584.001 Malware - T1587.001 Malware - T1588.001 Powershell - T1059.001 Process Doppelgänging - T1055.013 Process Hollowing - T1055.012 Process Injection - T1631 Scheduled Task - T1053.005 Server - T1583.004 Server - T1584.004 Software - T1592.002 Powershell - T1086 Process Doppelgänging - T1186 Process Hollowing - T1093 Process Injection - T1055 Scheduled Task - T1053
Show in Graph
Common Information
Type Value
UUID c98514f9-4dea-47c5-b0c1-fe552fc65e96
Fingerprint 17d49c9bc6bbaf80
Analysis status DONE
Considered CTI value 2
Text language
Published June 2, 2020, 4 p.m.
Added to db Sept. 26, 2022, 9:30 a.m.
Last updated Nov. 17, 2024, 6:55 p.m.
Headline In-depth analysis of the new Team9 malware family
Title In-depth analysis of the new Team9 malware family
Detected Hints/Tags/Attributes 63/3/126
Source URLs
Redirection Url
Details Source https://blog.fox-it.com/2020/06/02/in-depth-analysis-of-the-new-team9-malware-family/
URL Provider
Details Provider Source level domain
Details fox-it.com blog.fox-it.com
Attributes
Details Type #Events CTI Value
Details File 312 
calc.exe
Details sha256 2 
35b3fe2331a4a7d83d203e75ece5189b7d6d06af4abac8906348c0720b6278a4
Details sha256 2 
2342c736572ab7448ef8da2540cdbf0bae72625e41dab8fff58866413854ca5c
Details sha256 2 
4f258184d5462f64c3a752ec25fb5c193352c34206022c0755e48774592b7707
Details sha256 2 
b10dcec77e00b1f9b1f2e8e327a536987ca84bcb6b0c7327c292f87ed603837d
Details sha256 2 
363b6e0bc8873a6a522fe9485c7d8b4cbcffa1da61787930341f94557487c5a8
Details sha256 2 
f4a5fe23e21b6b7d63fa2d2c96a4bc4a34b40fd40a921b237a50a5976fe16001
Details sha256 2 
a0d0cfa8bf0bc5b8f769d8b64eab22d308b108dd8a4d59872946d69c3f8c58a5
Details sha256 2 
059519e03772d6eeea9498625ae8b8b7cf2f01fc8179ca5d33d6bcf29d07c9f4
Details sha256 2 
0f94b77892f22d0a0e7095b985f30b5edbe17ab5b8d41f798ef0c708709636f4
Details sha256 2 
2f0f0956628d7787c62f892e1bd9edda8b4c478cf8f1e65851052c7ad493dc28
Details sha256 2 
37d713860d529cbe4eab958419ffd7ebb3dc53bb6909f8bd360adaa84700faf2
Details sha256 2 
3400a7df9ec3dc8283d5ac7accb6935691e93feda066cc46c6c04d67f7f87b2b
Details sha256 2 
5974d938bc3bbfc69f68c979a6dc9c412970fc527500735385c33377ab30373a
Details sha256 2 
c55f8979995df82555d66f6b197b0fbcb8fe30b431ff9760deae6927a584b9e3
Details sha256 2 
94dcaa51e792d1fa266cae508c2c62a2ca45b94e2fdfbca7ea126b6cd7bc5b21
Details sha256 2 
4ee0857d475e67945af2c5e04be4dec3d6d3eb7c78700f007a7ff6f8c14d4cb3
Details sha256 2 
8f552e9ca2bedd90ce9935a665758d5de2e86b6fda32d98918534a8a5881f91a
Details sha256 2 
ae7daa7ce3188ccfe4069ba14c486631eea9505b7a107a17ddee29061b0ede99
Details sha256 2 
f3c6d7309f00cc7009bea4be6128f0af2ea6b87ab7a687d14092f85ccd35c1f5
Details sha256 2 
6cbf7795618fb5472c5277000d1c1de92b77724d77873b88af3819e431251f00
Details sha256 2 
b0b758e680e652144a78a7ddecc027d4868c1dc3d8d7d611ec4d3798358b0ce5
Details sha256 2 
959ba7923992386abf2e27357164672f29aac17ddd4ee1a8ad4c691a1c566568
Details sha256 2 
3fe61d87c9454554b0ce9101f95e18abad8ac6c62dcc88dc651ddfb20568e060
Details sha256 2 
b3764ef42d526a1ae1a4c3b0fe198f35c6bc5c07d5f155d15060b94f8f6dc695
Details sha256 2 
210c51aab6fc6c52326ece9dbd3ddab5f58e98432ef70c46936672c79542fbd0
Details sha256 2 
11b5adaefd04ffdaceb9539f95647b1f51aec2117d71ece061f15a2621f1ece9
Details sha256 2 
534d60392e0202b24d3fdaf992f299ef1af1fb5efef0096dd835fe5c4e30b0fa
Details sha256 2 
9d3a265688c1a098dd37fe77c139442a8eb02011da81972ceddc0cf4730f67cf
Details sha256 2 
ce478fdbd03573076394ac0275f0f7027f44a62a306e378fe52beb0658d0b273
Details sha256 2 
5a888d05804d06190f7fc408bede9da0423678c8f6eca37ecce83791de4df83d
Details sha256 2 
eb62ad35c613a73b0bd28c1779ace80e2ba587a7f8dbfec16cf5bf520caa71ee
Details sha256 2 
a76426e269a2defabcf7aef9486ff521c6110b64952267cfe3b77039d1414a41
Details sha256 2 
65cdbdd03391744be87ac8189e6cd105485ab754fed0b069a1378dca3e819f28
Details sha256 2 
38c9c3800dea2761b7faec078e4bbd2794b93a251513b3f683ae166d7f186d19
Details sha256 2 
8f8673e6c6353187dbb460088adc3099c2f35ad868966b257afa1df782e48875
Details sha256 2 
65e44fc8527204e88e38ab320b3e82694d1548639565fdaee53b7e0f963d3a92
Details sha256 2 
f53509af91159c3432c6faf4b4be2ae741a20ada05406f9d4e9ddbd48c91ebf9
Details sha256 2 
73339c130bb0faad27c852f925aa1a487eadf45df667db543f913db73080cd5d
Details sha256 2 
079a99b696cc984375d7a3228232c44153a167c1936c604ed553ac7be91dd982
Details sha256 2 
0d8aeacf4ebf227ba7412f8f057a8cddc54021846092b635c8d674b2e28052c6
Details sha256 2 
f83a815ce0457b50321706957c23ce8875318cfe5a6f983a0d0c580ebe359295
Details sha256 2 
3fa209cd62bacc0c2737a832e5f0d5fd1d874be94a206a29b3a10fa60ceb187d
Details sha256 2 
05abd7f33de873e9630f9e4f02dbd0cbc16dd254f305fc8f636dafba02a549b3
Details IPv4 1441 
127.0.0.1
Details IPv4 2 
185.64.106.73
Details IPv4 3 
34.222.222.126
Details IPv4 2 
71.191.52.192
Details IPv4 2 
77.213.120.90
Details IPv4 2 
179.43.134.164
Details IPv4 2 
185.65.202.62
Details IPv4 2 
220.32.32.128
Details IPv4 4 
51.81.113.26
Details IPv4 2 
85.204.116.58
Details IPv4 6 
51.254.25.115
Details IPv4 7 
193.183.98.66
Details IPv4 4 
91.217.137.37
Details IPv4 8 
87.98.175.85
Details IPv4 11 
185.121.177.177
Details IPv4 6 
169.239.202.202
Details IPv4 3 
198.251.90.143
Details IPv4 5 
5.132.191.104
Details IPv4 3 
111.67.20.8
Details IPv4 4 
163.53.248.170
Details IPv4 6 
142.4.204.111
Details IPv4 6 
142.4.205.47
Details IPv4 3 
158.69.239.167
Details IPv4 3 
104.37.195.178
Details IPv4 4 
192.99.85.244
Details IPv4 3 
158.69.160.164
Details IPv4 3 
46.28.207.199
Details IPv4 3 
31.171.251.118
Details IPv4 3 
81.2.241.148
Details IPv4 4 
82.141.39.32
Details IPv4 3 
50.3.82.215
Details IPv4 3 
46.101.70.183
Details IPv4 4 
5.45.97.127
Details IPv4 4 
130.255.78.223
Details IPv4 11 
144.76.133.38
Details IPv4 5 
139.59.208.246
Details IPv4 6 
172.104.136.243
Details IPv4 3 
45.71.112.70
Details IPv4 4 
163.172.185.51
Details IPv4 10 
5.135.183.146
Details IPv4 3 
51.255.48.78
Details IPv4 3 
188.165.200.156
Details IPv4 2 
147.135.185.78
Details IPv4 2 
92.222.97.145
Details IPv4 3 
51.255.211.146
Details IPv4 2 
159.89.249.249
Details IPv4 5 
104.238.186.189
Details IPv4 2 
139.59.23.241
Details IPv4 2 
94.177.171.127
Details IPv4 2 
45.63.124.65
Details IPv4 2 
212.24.98.54
Details IPv4 3 
178.17.170.179
Details IPv4 3 
185.208.208.141
Details IPv4 2 
82.196.9.45
Details IPv4 2 
146.185.176.36
Details IPv4 3 
89.35.39.64
Details IPv4 2 
89.18.27.167
Details IPv4 2 
77.73.68.161
Details IPv4 2 
185.117.154.144
Details IPv4 6 
176.126.70.119
Details IPv4 2 
139.99.96.146
Details IPv4 6 
217.12.210.54
Details IPv4 2 
185.164.136.225
Details IPv4 2 
192.52.166.110
Details IPv4 2 
63.231.92.27
Details IPv4 2 
66.70.211.246
Details IPv4 2 
96.47.228.108
Details IPv4 2 
45.32.160.206
Details IPv4 2 
128.52.130.209
Details IPv4 2 
35.196.105.24
Details IPv4 3 
172.98.193.42
Details IPv4 3 
162.248.241.94
Details IPv4 3 
107.172.42.186
Details IPv4 2 
167.99.153.82
Details IPv4 2 
138.197.25.214
Details IPv4 6 
69.164.196.21
Details IPv4 3 
94.247.43.254
Details IPv4 5 
94.16.114.254
Details IPv4 4 
151.80.222.79
Details IPv4 2 
176.9.37.132
Details IPv4 6 
192.71.245.208
Details IPv4 4 
195.10.195.195