MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 1694fe96af5b61266748982c92df975d59bc5cff275f2526fc866685b7447335. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AZORult


Vendor detections: 12


Intelligence 12 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 1694fe96af5b61266748982c92df975d59bc5cff275f2526fc866685b7447335
SHA3-384 hash: feb6a44cafa4f7dd7ed01604208ff494e8d86033667881a36a0a2a4ad82a2546a22aa42a39ae45d11f6a27a45cb21f9b
SHA1 hash: 26dbdea0866c5bc625e0d7568e0d65cc8d032be4
MD5 hash: a7442eb728e243c9e2a06ebe73fc68f7
humanhash: happy-burger-eleven-connecticut
File name:Scanjet 23002022.xlsx
Download: download sample
Signature AZORult
Create hunting rule
File size:191'160 bytes
First seen:2022-02-26 08:11:24 UTC
Last seen:Never
File type:Excel file xlsx
MIME type:application/encrypted
ssdeep 3072:ZHleO1edR2/U5dHP/9+8W7AkMQEf0aQ0pJ4J8Bav+EldNpn/IeqyIAVrkpWVkZ9/:wQMHAMjfX4J8RElPV/TzHVsAD4p
TLSH T17E14022625109D8BE00F60377645417CD945BD87EBF6E3E6E01E72ED2AF8B111AE908E
Reporter abuse_ch
Tags:AZORult CVE-2017-11882 VelvetSweatshop xlsx

Office OLE Information

This malware samples appears to be an Office document. The following table provides more information about this document using oletools and oledump.

OLE dump
Detection: VelvetSweatshop

MalwareBazaar was able to identify 6 sections in this file using oledump:

Section IDSection sizeSection name
164 bytesDataSpaces/DataSpaceInfo/StrongEncryptionDataSpace
2112 bytesDataSpaces/DataSpaceMap
3208 bytesDataSpaces/TransformInfo/StrongEncryptionTransform/Primary
476 bytesDataSpaces/Version
5184504 bytesEncryptedPackage
6224 bytesEncryptionInfo

Intelligence

File Origin
# of uploads :
1
# of downloads :
566
Origin country :
n/a
Vendor Threat Intelligence
Verdict:
Malicious
File type:
application/vnd.openxmlformats-officedocument.spreadsheetml.sheet
Has a screenshot:
False
Contains macros:
False
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/244892/
Detection(s):
PUA.Doc.Packed.EncryptedDoc-6563700-0
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Searching for the window
Creating a window
Searching for synchronization primitives
Launching a process
Creating a file
Сreating synchronization primitives
Running batch commands
Creating a process with a hidden window
Sending an HTTP GET request to an infection source by exploiting the app vulnerability
Creating a process from a recently created file
Result
Verdict:
Malicious
File Type:
OOXML Excel File with Embedding Objects in Encrypted Excel File
Link:
https://app.docguard.net/1694fe96af5b61266748982c92df975d59bc5cff275f2526fc866685b7447335/results/dashboard
Document image
Image:
Download PNG
Document image
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
embedequation exploit shellcode VelvetSweatshop
Link:
https://www.filescan.io/uploads/6219e0d7b94fb38cb40e6e64/reports/b773676b-3bff-4e25-bb94-79f56c2a56d7/overview
Label:
Malicious
Suspicious Score:
9.8/10
Score Malicious:
99%
Score Benign:
1%
Link:
https://www.malware.ai/gui/files/?id=6cde9131-31a7-4b31-8e35-d4ac2aa8c885
Result
Verdict:
MALICIOUS
Link:
https://labs.inquest.net/dfi/sha256/1694fe96af5b61266748982c92df975d59bc5cff275f2526fc866685b7447335
Details
Macro Execution Coercion
Detected a document that appears to social engineer the user into activating embedded logic.
Document With No Content
Document contains little or no semantic information.
Result
Threat name:
Azorult gzRat
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.expl.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/946656
Signature
.NET source code contains potential unpacker
Antivirus detection for URL or domain
C2 URLs / IPs found in malware configuration
Drops PE files to the user root directory
Found malware configuration
Found many strings related to Crypto-Wallets (likely being stolen)
Injects a PE file into a foreign processes
Machine Learning detection for dropped file
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Office document tries to convince victim to disable security protection (e.g. to enable ActiveX or Macros)
Office equation editor drops PE file
Office equation editor starts processes (likely CVE 2017-11882 or CVE-2018-0802)
Sigma detected: Droppers Exploiting CVE-2017-11882
Sigma detected: EQNEDT32.EXE connecting to internet
Sigma detected: Execution from Suspicious Folder
Sigma detected: File Dropped By EQNEDT32EXE
Sigma detected: Suspicious Program Location with Network Connections
Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)
Tries to harvest and steal browser information (history, passwords, etc)
Yara detected Azorult
Yara detected Azorult Info Stealer
Yara detected Costura Assembly Loader
Yara detected gzRat
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 579140 Sample: Scanjet 23002022.xlsx Startdate: 26/02/2022 Architecture: WINDOWS Score: 100 57 Snort IDS alert for network traffic (e.g. based on Emerging Threat rules) 2->57 59 Found malware configuration 2->59 61 Malicious sample detected (through community Yara rule) 2->61 63 20 other signatures 2->63 8 EQNEDT32.EXE 12 2->8         started        13 EXCEL.EXE 33 27 2->13         started        15 Pthmzffh.exe 1 2->15         started        process3 dnsIp4 53 192.210.218.119, 49165, 80 AS-COLOCROSSINGUS United States 8->53 37 C:\Users\user\AppData\Local\...\vbc[1].exe, PE32 8->37 dropped 39 C:\Users\Public\vbc.exe, PE32 8->39 dropped 67 Office equation editor starts processes (likely CVE 2017-11882 or CVE-2018-0802) 8->67 17 vbc.exe 13 3 8->17         started        41 C:\Users\user\...\~$Scanjet 23002022.xlsx, data 13->41 dropped 22 cmd.exe 15->22         started        file5 signatures6 process7 dnsIp8 51 etapackbg.com 172.67.166.49, 49166, 80 CLOUDFLARENETUS United States 17->51 35 C:\Users\user\AppData\...\Pthmzffh.exe, PE32 17->35 dropped 65 Injects a PE file into a foreign processes 17->65 24 vbc.exe 59 17->24         started        29 cmd.exe 17->29         started        31 timeout.exe 22->31         started        file9 signatures10 process11 dnsIp12 55 clamprite.ga 80.66.64.174, 49167, 49169, 80 VAD-SRL-AS1MD Russian Federation 24->55 43 C:\Users\user\AppData\...\vcruntime140.dll, PE32 24->43 dropped 45 C:\Users\user\AppData\Local\...\ucrtbase.dll, PE32 24->45 dropped 47 C:\Users\user\AppData\Local\...\softokn3.dll, PE32 24->47 dropped 49 45 other files (none is malicious) 24->49 dropped 69 Tries to harvest and steal browser information (history, passwords, etc) 24->69 33 timeout.exe 29->33         started        file13 signatures14 process15
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/1694fe96af5b61266748982c92df975d59bc5cff275f2526fc866685b7447335/
Threat name:
Document-OLE.Exploit.CVE-2017-11882
Create hunting rule
Status:
Malicious
First seen:
2022-02-26 08:12:11 UTC
File Type:
Document
Extracted files:
50
AV detection:
13 of 43 (30.23%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=c2kp5fvplnqsmz2itawjfx4xlvm3yxh7e5pskjx4qztiln2eom2q._file
Result
Malware family:
azorult
Create hunting rule
Score:
  10/10
Tags:
family:azorult collection discovery infostealer persistence spyware stealer trojan
Link:
https://tria.ge/reports/220226-j3vw5aaae7/
Behaviour
Checks processor information in registry
Delays execution with timeout.exe
Enumerates system info in registry
Launches Equation Editor
Modifies Internet Explorer settings
Modifies registry class
Suspicious behavior: AddClipboardFormatListener
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of FindShellTrayWindow
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
outlook_office_path
outlook_win_path
Enumerates physical storage devices
Suspicious use of SetThreadContext
Accesses Microsoft Outlook profiles
Accesses cryptocurrency files/wallets, possible credential harvesting
Adds Run key to start application
Checks installed software on the system
Loads dropped DLL
Reads data files stored by FTP clients
Reads local data of messenger clients
Reads user/profile data of local email clients
Reads user/profile data of web browsers
Uses the VBS compiler for execution
Blocklisted process makes network request
Downloads MZ/PE file
Executes dropped EXE
Azorult
Malware Config
C2 Extraction:
http://clamprite.ga/azo01/index.php
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/1694fe96af5b61266748982c92df975d59bc5cff275f2526fc866685b7447335

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/244892/

Comments