MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 2a3b9417a90179a848e9dd0cb628bc88042d284505901f092aa77a360c09e405. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AZORult


Vendor detections: 19


Intelligence 19 IOCs YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 2a3b9417a90179a848e9dd0cb628bc88042d284505901f092aa77a360c09e405
SHA3-384 hash: 975aca01b9d29b81731f2b18b1cd8e813eae3860f47dac366de31e01d4166f43a1d4ab1e3d433257b49dd9d8fe6cd923
SHA1 hash: 3e4c29a668ab5db7a2e3fc3ed0d7cce90cd3111c
MD5 hash: baf9ca75d335e33b6bc63ffe2f7149d9
humanhash: venus-ten-sink-charlie
File name:baf9ca75d335e33b6bc63ffe2f7149d9.exe
Download: download sample
Signature AZORult
Create hunting rule
File size:210'492 bytes
First seen:2023-03-27 04:01:09 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash 61259b55b8912888e90f516ca08dc514 (1'059 x Formbook, 741 x AgentTesla, 427 x GuLoader)
ssdeep 3072:2fY/TU9fE9PEtu4TSkvVcbloANFF8WA1LBLoNFhqdxG3ZIPFpVDCWh8Y6N3+j5jX:gYa6oBAloAipdoj1pYxedG56bb6RT
TLSH T11324F1956294C167ECB20631163AAF461ED7ED2628D426076341FE9F3A73382EC6E307
TrID 47.3% (.EXE) Win32 Executable MS Visual C++ (generic) (31206/45/13)
15.9% (.EXE) Win64 Executable (generic) (10523/12/4)
9.9% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
7.6% (.EXE) Win16 NE executable (generic) (5038/12/1)
6.8% (.EXE) Win32 Executable (generic) (4505/5/1)
File icon (PE):PE icon
dhash icon e0e4a3a6a4b8b8a8 (37 x Formbook, 9 x AZORult, 9 x Loki)
Reporter abuse_ch
Tags:AZORult exe


Avatar
abuse_ch
AZORult C2:
http://85.31.45.29/Godblessings/index.php

Intelligence

File Origin
# of uploads :
1
# of downloads :
284
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
azorult
Create hunting rule
ID:
1
File name:
baf9ca75d335e33b6bc63ffe2f7149d9.exe
Verdict:
Malicious activity
Analysis date:
2023-03-27 04:02:46 UTC
Tags:
trojan rat azorult
Link:
https://app.any.run/tasks/924b676b-7d7d-40c1-8840-9419dd153e18

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
Azorult
Create hunting rule
Link:
https://www.capesandbox.com/analysis/377697/
Result
Verdict:
Malware
Maliciousness:

Behaviour
Searching for the window
Creating a file in the %temp% directory
Creating a window
Creating a process from a recently created file
Сreating synchronization primitives
Sending an HTTP POST request
Creating a file
Reading critical registry keys
Running batch commands
Creating a process with a hidden window
Launching a process
Unauthorized injection to a recently created process
Unauthorized injection to a recently created process by context flags manipulation
Stealing user critical data
Result
Malware family:
n/a
Score:
  5/10
Tags:
n/a
Link:
https://dragonfly.certego.net/analysis/75105/overview
Behaviour
MalwareBazaar
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
comodo formbook nemesis overlay packed remcos shell32.dll
Link:
https://www.filescan.io/uploads/6421153c8f3f4544f6cc44b2/reports/7a16bf32-b188-42cc-975f-1c093d3b9394/overview
Verdict:
Malicious
Labled as:
Win/malicious_confidence_100%
Link:
https://www.hybrid-analysis.com/sample/2a3b9417a90179a848e9dd0cb628bc88042d284505901f092aa77a360c09e405
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
AZORult
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/f8274559-f5bb-4cc7-833a-6d4fa9512b0b
Result
Threat name:
Azorult
Create hunting rule
Detection:
malicious
Classification:
rans.phis.troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1202390
Signature
Antivirus detection for URL or domain
C2 URLs / IPs found in malware configuration
Detected unpacking (changes PE section rights)
Found many strings related to Crypto-Wallets (likely being stolen)
Found potential ransomware demand text
Icon mismatch, binary includes an icon from a different legit application in order to fool users
Malicious sample detected (through community Yara rule)
Maps a DLL or memory area into another process
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Snort IDS alert for network traffic
Tries to harvest and steal browser information (history, passwords, etc)
Tries to harvest and steal ftp login credentials
Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)
Tries to steal Instant Messenger accounts or passwords
Tries to steal Mail credentials (via file / registry access)
Yara detected Azorult
Yara detected Azorult Info Stealer
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 835295 Sample: AKMggIO7Rc.exe Startdate: 27/03/2023 Architecture: WINDOWS Score: 100 48 Snort IDS alert for network traffic 2->48 50 Malicious sample detected (through community Yara rule) 2->50 52 Antivirus detection for URL or domain 2->52 54 7 other signatures 2->54 9 AKMggIO7Rc.exe 19 2->9         started        process3 file4 36 C:\Users\user\AppData\Local\...\irgmnnaq.exe, PE32 9->36 dropped 12 irgmnnaq.exe 1 9->12         started        process5 signatures6 56 Multi AV Scanner detection for dropped file 12->56 58 Detected unpacking (changes PE section rights) 12->58 60 Maps a DLL or memory area into another process 12->60 15 irgmnnaq.exe 63 12->15         started        20 conhost.exe 12->20         started        process7 dnsIp8 38 85.31.45.29, 49695, 49698, 80 CLOUDCOMPUTINGDE Germany 15->38 28 C:\Users\user\AppData\...\vcruntime140.dll, PE32 15->28 dropped 30 C:\Users\user\AppData\Local\...\ucrtbase.dll, PE32 15->30 dropped 32 C:\Users\user\AppData\Local\...\softokn3.dll, PE32 15->32 dropped 34 45 other files (none is malicious) 15->34 dropped 40 Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc) 15->40 42 Tries to steal Instant Messenger accounts or passwords 15->42 44 Tries to steal Mail credentials (via file / registry access) 15->44 46 2 other signatures 15->46 22 cmd.exe 1 15->22         started        file9 signatures10 process11 process12 24 conhost.exe 22->24         started        26 timeout.exe 1 22->26         started       
Detection:
azorult
Create hunting rule
Link:
https://mwdb.cert.pl/sample/2a3b9417a90179a848e9dd0cb628bc88042d284505901f092aa77a360c09e405/
Threat name:
Win32.Trojan.Leonem
Create hunting rule
Status:
Malicious
First seen:
2023-03-23 05:46:00 UTC
File Type:
PE (Exe)
Extracted files:
3
AV detection:
21 of 24 (87.50%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=fi5zif5jaf42qshj3uglmkf4racc2kcfawib6cjku55dmdaj4qcq._file
Verdict:
malicious
Label(s):
azorult
Create hunting rule
Result
Malware family:
azorult
Create hunting rule
Score:
  10/10
Tags:
family:azorult infostealer trojan
Link:
https://tria.ge/reports/230327-elsm8abe84/
Behaviour
Suspicious behavior: MapViewOfSection
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Suspicious use of SetThreadContext
Executes dropped EXE
Loads dropped DLL
Azorult
Malware Config
C2 Extraction:
http://85.31.45.29/Godblessings/index.php
Unpacked files
SH256 hash:
69cee00fd47dbf3bf3625734286d0f97a271d0a3021839e573db84aa7d223184
MD5 hash:
44de72e22fe4533266cb2dd7cab7b040
SHA1 hash:
9f5985be824d840b740dcc281799fa62ccbebef0
Link:
https://www.unpac.me/results/4bbcaf20-77c1-4eb1-9f93-d7f08e22f546/
SH256 hash:
baa5a5608b7e1ced02ef19749dc61752c3c12035d8979ca988430bd0843c003d
MD5 hash:
1dceab3493bbcc6a93f095cf4a5cf5d7
SHA1 hash:
ee775c46f27e5658ebe23885558a75ec774b8b92
Detections:
Azorult
Create hunting rule
win_azorult_auto
Create hunting rule
win_azorult_g1
Create hunting rule
Link:
https://www.unpac.me/results/4bbcaf20-77c1-4eb1-9f93-d7f08e22f546/
SH256 hash:
2a3b9417a90179a848e9dd0cb628bc88042d284505901f092aa77a360c09e405
MD5 hash:
baf9ca75d335e33b6bc63ffe2f7149d9
SHA1 hash:
3e4c29a668ab5db7a2e3fc3ed0d7cce90cd3111c
Link:
https://www.unpac.me/results/4bbcaf20-77c1-4eb1-9f93-d7f08e22f546/
Malware family:
AZORult v3
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/2a3b9417a901/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/2a3b9417a90179a848e9dd0cb628bc88042d284505901f092aa77a360c09e405

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:shellcode
Create hunting rule
Author:nex
Description:Matched shellcode byte patterns

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/377697/

Comments