MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 35a26a7cc7d31b595a3931172ed60e34e50bbdc56c848d617cb394146e09a8ef. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

AZORult

Vendor detections: 4

Intelligence 4 IOCs YARA File information Comments

SHA256 hash:	35a26a7cc7d31b595a3931172ed60e34e50bbdc56c848d617cb394146e09a8ef
SHA3-384 hash:	719118faf111be60ab0f45045627ce43af9148931085f7f4b43d09549a7c46170b7b32c198dac773606a7875f79c2928
SHA1 hash:	163566b8ac859e16007ae70cfe63432bd840b86d
MD5 hash:	76c17a866fac5e2e285b41ba9db38ed8
humanhash:	sweet-may-montana-kansas
File name:	6d042b7c2bfba7cf917af858de2e5a38.exe
Download:	download sample
Signature	AZORult Create hunting rule
File size:	115'200 bytes
First seen:	2020-03-28 16:58:13 UTC
Last seen:	Never
File type:	exe
MIME type:	application/x-dosexec
imphash	6d1f2b41411eacafcf447fc002d8cb00 (139 x AZORult)
ssdeep	3072:tuOSXpMx7ZAlHsbfUkolNGti7lfqeSxM3SpyEY3E/txg/:Zzx7ZApszolIo7lf/ipT/t
Threatray	341 similar samples on MalwareBazaar
TLSH	43B3197AF6C19672E02808BDCD46D1B6912D76302D3918B6B2DA4F8CD5F95C26E1C3C7
Reporter	abuse_ch
Tags:	AZORult exe GuLoader

abuse_ch

Payload dropped by GuLoader from the following URL:
http://ufostream.com/xop/vla_encrypted_69CBA70.bin

Intelligence

File Origin

# of uploads :

# of downloads :

101

Origin country :

n/a

Vendor Threat Intelligence

Detection(s):

Win.Ransomware.Delf-6651871-0

Win.Malware.Delf-6957976-0

Gathering data

Threat name:

Win32.Trojan.Delf

Status:

Malicious

First seen:

2020-03-27 06:11:04 UTC

File Type:

PE (Exe)

AV detection:

31 of 31 (100.00%)

Threat level:

5/5

Detection(s):

Malicious file

Link:

https://check.spamhaus.org/check/?searchterm=gwrgu7gh2mnvswrzgels5vqogtsqxpofnsci2yl4wokbi3qjvdxq._file

Verdict:

malicious

Label(s):

azorult

Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

31e3d38fc732ef5528e17bb0df7764025cf789cb98f115ab5e8414c1ec5f4276

AZORult

exe 35a26a7cc7d31b595a3931172ed60e34e50bbdc56c848d617cb394146e09a8ef

(this sample)

Dropped by

MD5 6d042b7c2bfba7cf917af858de2e5a38

Dropped by

MD5 af48945745c7304dd191fbe54649375a

Dropped by

GuLoader

Dropped by

SHA256 31e3d38fc732ef5528e17bb0df7764025cf789cb98f115ab5e8414c1ec5f4276

Dropped by

SHA256 619c63bc8a1474a4c7ddd960d40c73962bbdec9aa7256f6e8415ca8599b88c1b

URLhaus

https://urlhaus.abuse.ch/url/331483/

BLint

The following table provides more information about this file using BLint. BLint is a Binary Linter to check the security properties, and capabilities in executables.

Findings

ID	Title	Severity
CHECK_AUTHENTICODE	Missing Authenticode	high
CHECK_NX	Missing Non-Executable Memory Protection	critical
CHECK_PIE	Missing Position-Independent Executable (PIE) Protection	high

Reviews

ID	Capabilities	Evidence
AUTH_API	Manipulates User Authorization	advapi32.dll::FreeSid
COM_BASE_API	Can Download & Execute components	ole32.dll::CoCreateInstance
WIN_BASE_API	Uses Win Base API	kernel32.dll::LoadLibraryExW kernel32.dll::LoadLibraryA kernel32.dll::GetSystemInfo kernel32.dll::GetStartupInfoA kernel32.dll::GetCommandLineA
WIN_BASE_IO_API	Can Create Files	kernel32.dll::CopyFileW kernel32.dll::CreateDirectoryW kernel32.dll::DeleteFileW kernel32.dll::GetFileAttributesW kernel32.dll::FindFirstFileW
WIN_REG_API	Can Manipulate Windows Registry	advapi32.dll::RegOpenKeyExA advapi32.dll::RegQueryValueExA

Comments

Login required

You need to login to in order to write a comment. Login with your abuse.ch account.

No comments found for this malware sample