MalwareBazaar Database
You are currently viewing the MalwareBazaar entry for SHA256 1d04af45a5f23bbffbe5fa0af2683234c2f70c234baf75cdf53f232523490b2b. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.
Database Entry
AZORult
Vendor detections: 18
| SHA256 hash: | 1d04af45a5f23bbffbe5fa0af2683234c2f70c234baf75cdf53f232523490b2b |
|---|---|
| SHA3-384 hash: | 61e8eb24fccd2b16238ab0f2b9bfeacf4a1e56ee8490fcc96f3147e1da1773a368964de6ec1d8176425538f5cbc17183 |
| SHA1 hash: | 71696c57e08d2611547820602f466088d7999119 |
| MD5 hash: | ab92ac92a5660397fd2bb0bf54e405e7 |
| humanhash: | cardinal-king-fish-massachusetts |
| File name: | PO#KOG21-PILOT18-WLM20 and PO#MIC06-M IN F 06.exe |
| Download: | download sample |
| Signature | AZORult |
| File size: | 546'304 bytes |
| First seen: | 2024-04-17 10:45:40 UTC |
| Last seen: | 2024-04-17 11:40:23 UTC |
| File type: |  exe |
| MIME type: | application/x-dosexec |
| imphash | f34d5f2d4577ed6d9ceec516c1f5a744 (48'652 x AgentTesla, 19'463 x Formbook, 12'204 x SnakeKeylogger) |
| ssdeep | 12288:vlOATP7Umq9adG75huKA6QMy1dHswGSoKluxdXXxd1672cWjoIC:sAD7Lq97ju96VUHT0KluxBD4rA |
| Threatray | 61 similar samples on MalwareBazaar |
| TLSH | T1C9C41287F022679EF8BE83BB79C6091657F161661843E7040DB13FD4BE65B805BC8A1B |
| TrID | 71.1% (.EXE) Generic CIL Executable (.NET, Mono, etc.) (73123/4/13) 10.2% (.EXE) Win64 Executable (generic) (10523/12/4) 6.3% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2) 4.3% (.EXE) Win32 Executable (generic) (4504/4/1) 2.0% (.ICL) Windows Icons Library (generic) (2059/9) |
| File icon (PE): |  |
| dhash icon | 94327292e8ccb4c8 (5 x Formbook, 3 x AgentTesla, 2 x RemcosRAT) |
| Reporter |  abuse_ch |
| Tags: | AZORult exe |
Intelligence
File Origin
# of uploads :
2
# of downloads :
349
Origin country :
NLVendor Threat Intelligence
Malware family:
azorult
ID:
1
File name:
1d04af45a5f23bbffbe5fa0af2683234c2f70c234baf75cdf53f232523490b2b.exe
Verdict:
Malicious activity
Analysis date:
2024-04-17 10:46:23 UTC
Tags:
stealer azorult
Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Result
Verdict:
Malware
Maliciousness:
Behaviour
Searching for the window
Creating a window
Сreating synchronization primitives
Launching a process
Creating a file
DNS request
Connection attempt
Sending an HTTP POST request
Creating a file in the %temp% subdirectories
Reading critical registry keys
Running batch commands
Creating a process with a hidden window
Stealing user critical data
Unauthorized injection to a system process
Verdict:
Suspicious
Threat level:
5/10
Confidence:
100%
Tags:
packed
Verdict:
Malicious
Labled as:
Win/malicious_confidence_100%
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
AZORult
Verdict:
Malicious
Result
Threat name:
Azorult
Detection:
malicious
Classification:
phis.spyw.evad
Score:
100 / 100
Signature
.NET source code contains potential unpacker
.NET source code contains very large array initializations
Antivirus / Scanner detection for submitted sample
Found many strings related to Crypto-Wallets (likely being stolen)
Initial sample is a PE file and has a suspicious name
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for domain / URL
Multi AV Scanner detection for submitted file
Snort IDS alert for network traffic
Tries to harvest and steal Bitcoin Wallet information
Tries to harvest and steal browser information (history, passwords, etc)
Tries to harvest and steal ftp login credentials
Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)
Tries to steal Crypto Currency Wallets
Tries to steal Instant Messenger accounts or passwords
Tries to steal Mail credentials (via file / registry access)
Yara detected AntiVM3
Yara detected Azorult
Yara detected Azorult Info Stealer
Behaviour
Behavior Graph:
Score:
100%
Verdict:
Malware
File Type:
PE
Detection:
azorult
Threat name:
ByteCode-MSIL.Trojan.Heracles
Status:
Malicious
First seen:
2024-04-17 10:46:06 UTC
File Type:
PE (.Net Exe)
Extracted files:
10
AV detection:
20 of 24 (83.33%)
Threat level:
5/5
Detection(s):
Suspicious file
Verdict:
malicious
Label(s):
azorult
Similar samples:
+ 51 additional samples on MalwareBazaar
Result
Malware family:
azorult
Score:
10/10
Tags:
family:azorult collection infostealer spyware stealer trojan
Behaviour
Checks processor information in registry
Delays execution with timeout.exe
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
outlook_office_path
outlook_win_path
Suspicious use of SetThreadContext
Accesses Microsoft Outlook profiles
Accesses cryptocurrency files/wallets, possible credential harvesting
Loads dropped DLL
Reads local data of messenger clients
Azorult
Malware Config
C2 Extraction:
http://ccrhs.shop/MI341/index.php
Unpacked files
SH256 hash:
1c633f39a192f108f755e0bcf412e8489ad80781f3b7807c80892deb2526ff0d
MD5 hash:
e4b5d57e9e46a4e76075b5b92f71577f
SHA1 hash:
d76dc165724148193c6911cc75fc62c198737d3a
SH256 hash:
4371d52200c0f75f764fa68f433a1c40f2e5f717d801e692aeecf709faf06ba0
MD5 hash:
0ca47d738daf5b564d0326f188207e2e
SHA1 hash:
c39c2c6dcf8220ffa894fdf67efffb93474a1755
Detections:
Azorult
win_azorult_auto
win_azorult_g1
Azorult
SH256 hash:
3e09fa414fc86812760253e5b6931914064be9c5470443fbac85c58c0dc7fe77
MD5 hash:
db205fca382c6ee86b55e77c322584c2
SHA1 hash:
9f97d558dbe4adbc3bbef25b331abd987a08f76e
SH256 hash:
5535da57dff104ab0ab5aa076a7b45b6793c3d66e4959365bbbdb8d0250d9b16
MD5 hash:
0e21567e4474815a079caff052536416
SHA1 hash:
29cd2b456b854d777af395a5eaca9c80d9ad13e1
SH256 hash:
1d04af45a5f23bbffbe5fa0af2683234c2f70c234baf75cdf53f232523490b2b
MD5 hash:
ab92ac92a5660397fd2bb0bf54e405e7
SHA1 hash:
71696c57e08d2611547820602f466088d7999119
Malware family:
AZORult v3
Verdict:
Malicious
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
YARA Signatures
MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.
| Rule name: | AgentTesla_DIFF_Common_Strings_01 |
|---|---|
| Author: | schmidtsz |
| Description: | Identify partial Agent Tesla strings |
| Rule name: | NET |
|---|---|
| Author: | malware-lu |
| Rule name: | NETexecutableMicrosoft |
|---|---|
| Author: | malware-lu |
| Rule name: | pe_imphash |
|---|
| Rule name: | Skystars_Malware_Imphash |
|---|---|
| Author: | Skystars LightDefender |
| Description: | imphash |
File information
The table below shows additional information about this malware sample such as delivery method and external references.
No further information available
BLint
The following table provides more information about this file using BLint. BLint is a Binary Linter to check the security properties, and capabilities in executables.
Findings
| ID | Title | Severity |
|---|---|---|
| CHECK_AUTHENTICODE | Missing Authenticode | high |
| CHECK_DLL_CHARACTERISTICS | Missing dll Security Characteristics (HIGH_ENTROPY_VA) | high |
Comments
Login required
You need to login to in order to write a comment. Login with your abuse.ch account.