MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 6e10a2668f758a105e33b8cc649173fcadc5c7f5a58f7e88e9512224a4fa9a6c. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

AZORult

Vendor detections: 4

Intelligence 4 IOCs YARA File information Comments

SHA256 hash:	6e10a2668f758a105e33b8cc649173fcadc5c7f5a58f7e88e9512224a4fa9a6c
SHA3-384 hash:	93627ddc365e422188b310f686fb9246879948eb72d16c594f62129bf07730ca3be03060434577c257da644e8436922a
SHA1 hash:	19502ffe623e958b9e173c4e93123b4ab15a4ff5
MD5 hash:	ef9f43aa9b2f98c80127bdcbfaaafbe2
humanhash:	ten-india-massachusetts-black
File name:	8ca1e916557e3844a55e63cb403f31c8.exe
Download:	download sample
Signature	AZORult Create hunting rule
File size:	115'200 bytes
First seen:	2020-04-07 19:32:09 UTC
Last seen:	2020-04-13 09:06:20 UTC
File type:	exe
MIME type:	application/x-dosexec
imphash	6d1f2b41411eacafcf447fc002d8cb00 (139 x AZORult)
ssdeep	3072:tuOSXpMx7ZAlHsbfUkolNGti7lfqeSxM3SpyEY3E/Bxg/:Zzx7ZApszolIo7lf/ipT/B
Threatray	343 similar samples on MalwareBazaar
TLSH	F7B3197AF6C19672E02808BDCD46D1B6912D76302D3918B6B2DA4F8CE5F95C26E1C3C7
Reporter	abuse_ch
Tags:	AZORult exe GuLoader

abuse_ch

Payload dropped by GuLoader from the following URL:
http://nutandbolts.in/bukky_encrypted_D95B8CF.bin

Intelligence

File Origin

# of uploads :

# of downloads :

109

Origin country :

n/a

Vendor Threat Intelligence

Detection(s):

Win.Ransomware.Delf-6651871-0

Win.Malware.Delf-6957976-0

Gathering data

Threat name:

Win32.Trojan.Delf

Status:

Malicious

First seen:

2020-04-07 19:37:09 UTC

File Type:

PE (Exe)

AV detection:

44 of 46 (95.65%)

Threat level:

5/5

Detection(s):

Malicious file

Link:

https://check.spamhaus.org/check/?searchterm=nyikezupowfbaxrtxdggjelt7sw4lr7vuwhx5chjkercjjh2tjwa._file

Verdict:

malicious

Label(s):

azorult

Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

a8df50387c87b5d22a381e5cb1ed16a7146d2ce7a50d247b93160fb6408380e5

AZORult

exe 6e10a2668f758a105e33b8cc649173fcadc5c7f5a58f7e88e9512224a4fa9a6c

(this sample)

Dropped by

MD5 8ca1e916557e3844a55e63cb403f31c8

Dropped by

MD5 7283dd5f62238504d96a33e705e359e7

Dropped by

GuLoader

Dropped by

SHA256 a8df50387c87b5d22a381e5cb1ed16a7146d2ce7a50d247b93160fb6408380e5

Dropped by

SHA256 d0bdd009d11c503f1c17d7f47ef1ad43a87880da4352a769d31bde3bc4eaef5a

URLhaus

https://urlhaus.abuse.ch/url/336257/

BLint

The following table provides more information about this file using BLint. BLint is a Binary Linter to check the security properties, and capabilities in executables.

Findings

ID	Title	Severity
CHECK_AUTHENTICODE	Missing Authenticode	high
CHECK_NX	Missing Non-Executable Memory Protection	critical
CHECK_PIE	Missing Position-Independent Executable (PIE) Protection	high

Reviews

ID	Capabilities	Evidence
AUTH_API	Manipulates User Authorization	advapi32.dll::FreeSid
COM_BASE_API	Can Download & Execute components	ole32.dll::CoCreateInstance
WIN_BASE_API	Uses Win Base API	kernel32.dll::LoadLibraryExW kernel32.dll::LoadLibraryA kernel32.dll::GetSystemInfo kernel32.dll::GetStartupInfoA kernel32.dll::GetCommandLineA
WIN_BASE_IO_API	Can Create Files	kernel32.dll::CopyFileW kernel32.dll::CreateDirectoryW kernel32.dll::DeleteFileW kernel32.dll::GetFileAttributesW kernel32.dll::FindFirstFileW
WIN_REG_API	Can Manipulate Windows Registry	advapi32.dll::RegOpenKeyExA advapi32.dll::RegQueryValueExA

Comments

Login required

You need to login to in order to write a comment. Login with your abuse.ch account.

No comments found for this malware sample