MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 276cec63d7f2abe85a2e9caa2e636831be52ee7828156e1d01a413e5a1cfe9e4. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AZORult


Vendor detections: 11


Intelligence 11 IOCs 1 YARA 3 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 276cec63d7f2abe85a2e9caa2e636831be52ee7828156e1d01a413e5a1cfe9e4
SHA3-384 hash: de6fb98e46f94a5fcd034e07ca79d40401ca87ab50c9c50478913bb0b277c9578c3297ffdcde0520e645a726422e5763
SHA1 hash: 363f2238e0b39bf6a6d0124f117b34ce9407edcb
MD5 hash: a7370f318ae43c90446d3a0659ec77fc
humanhash: ohio-green-don-december
File name:3957211085.exe
Download: download sample
Signature AZORult
Create hunting rule
File size:422'271 bytes
First seen:2022-02-06 08:26:23 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash 099c0646ea7282d232219f8807883be0 (476 x Formbook, 210 x Loki, 107 x AgentTesla)
ssdeep 6144:BwTa4ogLeSp1faZwMsotn6H+VEqNxp5PMsirJDsaPzUqTh1+:kJTf1faHs3GxpgJvIi1+
Threatray 8'567 similar samples on MalwareBazaar
TLSH T19E94E4F871E1E279C80582312E617C7097F14DA0DDB1A916EDECF9E4D630EF62B22646
File icon (PE):PE icon
dhash icon 10808a8c8c8a8010 (77 x Formbook, 51 x AgentTesla, 44 x RemcosRAT)
Reporter abuse_ch
Tags:AZORult exe


Avatar
abuse_ch
AZORult C2:
http://31.210.20.167/cake/index.php

Indicators Of Compromise (IOCs)

Below is a list of indicators of compromise (IOCs) associated with this malware samples.

IOCThreatFox Reference
http://31.210.20.167/cake/index.php https://threatfox.abuse.ch/ioc/370949/

Intelligence

File Origin
# of uploads :
1
# of downloads :
476
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
3957211085.exe
Verdict:
Suspicious activity
Analysis date:
2022-02-06 11:01:03 UTC
Tags:
installer
Link:
https://app.any.run/tasks/0ba4baa6-629a-41a1-8ca7-0b7f62edddbf

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/233721/
Detection(s):
SecuriteInfo.com.FakeAV.CXA.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Searching for the window
Creating a file in the %temp% directory
Creating a file
Unauthorized injection to a recently created process
Сreating synchronization primitives
Sending an HTTP POST request
Reading critical registry keys
Creating a window
Running batch commands
Creating a process with a hidden window
Launching a process
DNS request
Stealing user critical data
Verdict:
Suspicious
Threat level:
  5/10
Confidence:
100%
Tags:
control.exe overlay packed shell32.dll
Link:
https://www.filescan.io/uploads/61ff865ca72f86da696123d3/reports/492356cf-2bd3-4227-bb8d-ed904ee81702/overview
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
Generic Malware
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/b8fb923d-f399-4099-89e4-efd8222dbc2e
Result
Threat name:
Azorult
Create hunting rule
Detection:
malicious
Classification:
phis.troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/934728
Signature
Antivirus detection for URL or domain
C2 URLs / IPs found in malware configuration
Found evasive API chain (may stop execution after reading information in the PEB, e.g. number of processors)
Found malware configuration
Found many strings related to Crypto-Wallets (likely being stolen)
Icon mismatch, binary includes an icon from a different legit application in order to fool users
Injects a PE file into a foreign processes
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for submitted file
Self deletion via cmd delete
Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)
Tries to harvest and steal Bitcoin Wallet information
Tries to harvest and steal browser information (history, passwords, etc)
Tries to harvest and steal ftp login credentials
Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)
Tries to steal Crypto Currency Wallets
Tries to steal Instant Messenger accounts or passwords
Tries to steal Mail credentials (via file / registry access)
Yara detected Azorult
Yara detected Azorult Info Stealer
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 567203 Sample: 3957211085.exe Startdate: 06/02/2022 Architecture: WINDOWS Score: 100 37 Snort IDS alert for network traffic (e.g. based on Emerging Threat rules) 2->37 39 Found malware configuration 2->39 41 Malicious sample detected (through community Yara rule) 2->41 43 8 other signatures 2->43 8 3957211085.exe 19 2->8         started        process3 file4 25 C:\Users\user\AppData\Local\...\lnpxapuja.dll, PE32 8->25 dropped 45 Self deletion via cmd delete 8->45 47 Found evasive API chain (may stop execution after reading information in the PEB, e.g. number of processors) 8->47 49 Injects a PE file into a foreign processes 8->49 12 3957211085.exe 67 8->12         started        signatures5 process6 dnsIp7 35 31.210.20.167, 49757, 49769, 80 PLUSSERVER-ASN1DE Netherlands 12->35 27 C:\Users\user\AppData\...\vcruntime140.dll, PE32 12->27 dropped 29 C:\Users\user\AppData\Local\...\ucrtbase.dll, PE32 12->29 dropped 31 C:\Users\user\AppData\Local\...\softokn3.dll, PE32 12->31 dropped 33 45 other files (none is malicious) 12->33 dropped 51 Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc) 12->51 53 Tries to steal Instant Messenger accounts or passwords 12->53 55 Tries to steal Mail credentials (via file / registry access) 12->55 57 4 other signatures 12->57 17 BackgroundTransferHost.exe 13 12->17         started        19 cmd.exe 1 12->19         started        file8 signatures9 process10 process11 21 conhost.exe 17->21         started        23 timeout.exe 1 17->23         started       
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/276cec63d7f2abe85a2e9caa2e636831be52ee7828156e1d01a413e5a1cfe9e4/
Threat name:
Win32.Trojan.SpyNoon
Create hunting rule
Status:
Malicious
First seen:
2022-02-06 08:27:11 UTC
File Type:
PE (Exe)
Extracted files:
4
AV detection:
22 of 43 (51.16%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=e5woyy6x6kv6qwrotsvc4y3igg7ff3tyfakw4hibuqj6liop5hsa._file
Verdict:
malicious
Label(s):
azorult
Create hunting rule
trickbot
Create hunting rule
Similar samples:
0caaaa5f4ab21a8ceaaded6e69be05b30e424980e159c6458b0c8379adee95da
AZORult
31c5ddd1fbe36e68985803eda63bfeaaccce58774389be0c0fc339d214ea1353
AZORult
4dd710964bb7577921fff55993ac0f007e489bb609fcf6ea50f5f949baa8504b
AZORult
5896ab6180021d7a1bad370dd224ef00e660c22aa7f92c928a7d1f2c44a8bf50
AZORult
6321c189d83bd48713f5a7b760d033082078e3104e148206d31c374532fbe07e
AZORult
8764b673268c50c93a845e89b84fe3d7e420807c049106bad73250799f04d5ec
AZORult
9218a2c4cfd9538b65b06202b850c2900e625477b176708d44e09a6bafbb5d43
AZORult
acfd67e70a3b73fa1c66207594fd2afb565fd437470c61f7c2de922d855e71ea
AZORult
bd35948712753f7a1c073fbf50e798898e0bbf9dec42a416eb33e2f78913c314
AZORult
e752bd103a473a433040a6522226aac9cecf8b5a8e6ab59fe386d63a5566b63c
AZORult
+ 8'557 additional samples on MalwareBazaar
Result
Malware family:
azorult
Create hunting rule
Score:
  10/10
Tags:
family:azorult infostealer suricata trojan
Link:
https://tria.ge/reports/220206-kcfj7aghgk/
Behaviour
Checks processor information in registry
Modifies data under HKEY_USERS
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: GetForegroundWindowSpam
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Program crash
Drops file in Windows directory
Loads dropped DLL
Azorult
suricata: ET MALWARE Win32/AZORult V3.3 Client Checkin M14
Unpacked files
SH256 hash:
5c60755147c732c6ae274b124cffbf776e26a957d5de88e2dc43e759cc5a071c
MD5 hash:
4515f1116c6084b4a363de7b6ce93c39
SHA1 hash:
a13abe45eb45dacb948b28b44d9b2ba0fa3e0ef4
Link:
https://www.unpac.me/results/16fb4b93-c60c-4e82-b2ca-d96851a6815a/
SH256 hash:
da96f93af5443cc3293cfcc148c6031817314f84f01338013b0ce231555f4728
MD5 hash:
9e617ee1e035c01ea704b44d916ce0c2
SHA1 hash:
3d60762b7eac2185e957cf4cfd6040541ffa3d55
Link:
https://www.unpac.me/results/16fb4b93-c60c-4e82-b2ca-d96851a6815a/
SH256 hash:
276cec63d7f2abe85a2e9caa2e636831be52ee7828156e1d01a413e5a1cfe9e4
MD5 hash:
a7370f318ae43c90446d3a0659ec77fc
SHA1 hash:
363f2238e0b39bf6a6d0124f117b34ce9407edcb
Link:
https://www.unpac.me/results/16fb4b93-c60c-4e82-b2ca-d96851a6815a/
Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:Azorult
Create hunting rule
Author:kevoreilly
Description:Azorult Payload
Rule name:malware_Azorult
Create hunting rule
Author:JPCERT/CC Incident Response Group
Description:detect Azorult in memory
Reference:internal research
Rule name:win_azorult_auto
Create hunting rule
Author:Felix Bilstein - yara-signator at cocacoding dot com
Description:Detects win.azorult.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/233721/

Comments