MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 2b29b24f2a311158a4900bddf41fe482c42e46941a42468b4990fd467fde5f72. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	2b29b24f2a311158a4900bddf41fe482c42e46941a42468b4990fd467fde5f72
SHA3-384 hash:	5f6d99db9a38a9980375d7dbfb761d201e3ef44a12573e5649957474590176b01548240f13a46d7cd57bc435abdc84d3
SHA1 hash:	36c17d7e22c982d4991749f905f70941c5d36825
MD5 hash:	91e8ae0f98abcb16814261421bfe1f6b
humanhash:	pasta-kansas-pasta-video
File name:	LPO_Eco_Environ(ARTWORK).exe
Download:	download sample
Signature	AZORult Alert Create hunting rule
File size:	629'510 bytes
First seen:	2024-01-31 11:05:32 UTC
Last seen:	2024-01-31 12:50:20 UTC
File type:	exe
MIME type:	application/x-dosexec
imphash	e2a592076b17ef8bfb48b7e03965a3fc (419 x GuLoader, 63 x RemcosRAT, 52 x AgentTesla)
ssdeep	12288:MkKnLVq69Hrc82yTPZodHtRWztKK7RG1Jz8Ap2x9c8Q04fz/sGoisDsCVVLwOz3v:AQy6ONsqLN7UHZVrTrC
TLSH	T133D46B31B79BACD9C4190CF2515E03EF04D0E7AF165497C3E391ADAB7E2A581862B8D3
TrID	47.3% (.EXE) Win32 Executable MS Visual C++ (generic) (31206/45/13) 15.9% (.EXE) Win64 Executable (generic) (10523/12/4) 9.9% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2) 7.6% (.EXE) Win16 NE executable (generic) (5038/12/1) 6.8% (.EXE) Win32 Executable (generic) (4505/5/1)
File icon (PE):
dhash icon	00bef0f0f0fc8e00 (8 x AZORult, 5 x GuLoader)
Reporter	abuse_ch
Tags:	AZORult exe

Intelligence

---

File Origin

# of uploads :

2

# of downloads :

305

Origin country :

NL

Vendor Threat Intelligence

CAPE Sandbox

Detection:

n/a

Link:

https://www.capesandbox.com/analysis/473763/

ClamAV Detected

Detection(s):

SecuriteInfo.com.FileRepMalware.27223.18006.UNOFFICIAL

Alert

Create hunting rule

FileScan.IO Malicious

Verdict:

Malicious

Threat level:

  10/10

Confidence:

100%

Tags:

installer lolbin overlay packed shell32

Link:

https://www.filescan.io/uploads/65ba29a1bc91f83c8073d11f/reports/97bbe870-f6c5-491f-bf57-dd219c14fd6f/overview

Hybrid Analysis Jaik.Generic

Verdict:

Malicious

Labled as:

Jaik.Generic

Link:

https://www.hybrid-analysis.com/sample/2b29b24f2a311158a4900bddf41fe482c42e46941a42468b4990fd467fde5f72

Intezer Unknown

Verdict:

Unknown

Link:

https://analyze.intezer.com/analyses/9296fe39-e526-4f23-8037-f6b02c437ec8

Joe Sandbox GuLoader, Azorult

Result

Threat name:

GuLoader, Azorult

Alert

Create hunting rule

Detection:

malicious

Classification:

troj.evad.phis.spyw

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/1383990

Signature

Antivirus / Scanner detection for submitted sample

Antivirus detection for URL or domain

Found many strings related to Crypto-Wallets (likely being stolen)

Hides threads from debuggers

Initial sample is a PE file and has a suspicious name

Multi AV Scanner detection for domain / URL

Multi AV Scanner detection for submitted file

Self deletion via cmd or bat file

Snort IDS alert for network traffic

Tries to harvest and steal Bitcoin Wallet information

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal ftp login credentials

Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)

Tries to steal Crypto Currency Wallets

Tries to steal Instant Messenger accounts or passwords

Tries to steal Mail credentials (via file / registry access)

Yara detected Azorult

Yara detected GuLoader

Behaviour

Behavior Graph:

Download SVG

Nucleon Malprob Malware

Score:

99%

Verdict:

Malware

File Type:

PE

Link:

https://malprob.io/report/2b29b24f2a311158a4900bddf41fe482c42e46941a42468b4990fd467fde5f72

CERT.PL MWDB

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/2b29b24f2a311158a4900bddf41fe482c42e46941a42468b4990fd467fde5f72/

ReversingLabs TitaniumCloud Win32.Trojan.GuLoader

Threat name:

Win32.Trojan.GuLoader

Alert

Create hunting rule

Status:

Malicious

First seen:

2024-01-30 08:26:50 UTC

AV detection:

20 of 24 (83.33%)

Threat level:

  5/5

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=fmu3etzkgeivrjeqbpo7ih7eqlcc4ruudjbenc2jsd6um766l5za._file

Threatray cloudeye

Verdict:

malicious

Label(s):

cloudeye

Alert

Create hunting rule

Hatching Triage azorult

Result

Malware family:

azorult

Alert

Create hunting rule

Score:

  10/10

Tags:

family:azorult infostealer trojan

Link:

https://tria.ge/reports/240131-m7fjsaceem/

Behaviour

Delays execution with timeout.exe

Enumerates physical storage devices

Drops file in Windows directory

Azorult

UnpacMe 3

Unpacked files

SH256 hash:

bd046e6497b304e4ea4ab102cab2b1f94ce09bde0eebba4c59942a732679e4eb

MD5 hash:

17ed1c86bd67e78ade4712be48a7d2bd

SHA1 hash:

1cc9fe86d6d6030b4dae45ecddce5907991c01a0

Link:

https://www.unpac.me/results/c646e3ff-f6df-4cd6-945d-5aac56bc4e46/

SH256 hash:

f21d9de02c67e51bb9f7163f676f2d4710b2befae04fd0751a63cf1278c48a3c

MD5 hash:

35119e61479373ba5d7433f106556e79

SHA1 hash:

096a7d227eb2514d76ec5d10bfd1cf165d4a9177

Link:

https://www.unpac.me/results/c646e3ff-f6df-4cd6-945d-5aac56bc4e46/

SH256 hash:

2b29b24f2a311158a4900bddf41fe482c42e46941a42468b4990fd467fde5f72

MD5 hash:

91e8ae0f98abcb16814261421bfe1f6b

SHA1 hash:

36c17d7e22c982d4991749f905f70941c5d36825

Link:

https://www.unpac.me/results/c646e3ff-f6df-4cd6-945d-5aac56bc4e46/

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

YOROI YOMI Malicious File

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/2b29b24f2a311158a4900bddf41fe482c42e46941a42468b4990fd467fde5f72

File information

---

The table below shows additional information about this malware sample such as delivery method and external references.

Cape

https://www.capesandbox.com/analysis/473763/