MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 353b74e4fca84879a4f7406e1ab7972761bfec524b15294b9feab567b8d0744b. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

AZORult

Vendor detections: 19

Intelligence 19 IOCs YARA 12 File information Comments

SHA256 hash:	353b74e4fca84879a4f7406e1ab7972761bfec524b15294b9feab567b8d0744b
SHA3-384 hash:	73eff15b336ffae4c77daad35f301f5226033245787a96fd85beea7214efdf213005948e8339ac305cf4f2d8ca1c14e4
SHA1 hash:	04e23dced5030e6ed1be15829a50b912fd386391
MD5 hash:	6b12afb775ec4b8a046f79f79164b5a8
humanhash:	xray-hydrogen-helium-virginia
File name:	keygen-step-1.exe
Download:	download sample
Signature	AZORult Create hunting rule
File size:	114'688 bytes
First seen:	2026-05-02 13:22:04 UTC
Last seen:	Never
File type:	exe
MIME type:	application/x-dosexec
imphash	6d1f2b41411eacafcf447fc002d8cb00 (141 x AZORult)
ssdeep	3072:KExRaX6raoCoCyz6/mqv1JR+yBtGOeaeWgiNq:faZ1tme++wiE
Threatray	1'160 similar samples on MalwareBazaar
TLSH	T178B32A6EF7C18277D02408BDCD45A1B9907975302E391822F7E64F6CD9F96C26A6C2C7
TrID	34.2% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2) 23.4% (.EXE) Win32 Executable (generic) (4504/4/1) 10.8% (.EXE) Win16/32 Executable Delphi generic (2072/23) 10.5% (.EXE) OS/2 Executable (generic) (2029/13) 10.4% (.EXE) Generic Win/DOS Executable (2002/3)
Magika	pebin
Reporter	aachum
Tags:	AZORult dnlg-eu-cc exe KeygenGuru

iamaachum

https://voidcache.ru/t/175be465eaq86n44.html => https://get.loadport.ru/d/download.php

AZORult C2: http://dnlg.eu.cc/8492015736.php

Intelligence

File Origin

# of uploads :

# of downloads :

198

Origin country :

Vendor Threat Intelligence

Malware configuration found for:

AZORult

Details

AZORult

a c2 url and decoding alphabet

Link:

https://research.acce.ciphertechsolutions.com/results/de832a66-b980-47d2-9165-0bf8767da3e4/

Malware family:

azorult

ID:

File name:

kodak.i1150.scanner.drivers.ar.archive.exe

Verdict:

Malicious activity

Analysis date:

2026-03-13 22:58:29 UTC

Tags:

azorult loader trojan pony fareit stealer miner shifu banking winring0-sys vuln-driver auto coinminer golang xmrig

Link:

https://app.any.run/tasks/5c482f2f-167b-448f-9d63-a3c110fc2683

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

Detection:

Azorult

Link:

https://www.capesandbox.com/analysis/64300/

Detection(s):

Win.Malware.Delf-6957976-0

YARA.CAPE_Azorult.UNOFFICIAL

Result

Verdict:

Malware

Maliciousness:

Behaviour

Сreating synchronization primitives

DNS request

Connection attempt

Sending an HTTP POST request

Creating a file in the %temp% subdirectories

Creating a file

Reading critical registry keys

Launching a service

Changing a file

Running batch commands

Creating a process with a hidden window

Launching a process

Stealing user critical data

Verdict:

Malicious

Threat level:

10/10

Confidence:

100%

Tags:

adaptive-context azorult base64 borland_delphi crypt fingerprint infostealer kbot packed stealer unsafe windows xpack

Link:

https://www.filescan.io/uploads/69f5fa932fcb905ec27a346e/reports/78a758cd-ff45-428a-a35d-f225e34c9dde/overview

Verdict:

Malicious

Labled as:

Trojan.Generic

Link:

https://www.hybrid-analysis.com/sample/353b74e4fca84879a4f7406e1ab7972761bfec524b15294b9feab567b8d0744b

Verdict:

Malicious

File Type:

exe x32

First seen:

2026-03-01T00:21:00Z UTC

Last seen:

2026-05-04T09:09:00Z UTC

Hits:

~100

Detections:

Trojan-PSW.Win32.Azorult.sb HEUR:Trojan-PSW.Win32.Generic Trojan-PSW.Azorult.HTTP.C&C BSS:Trojan.Win32.Generic Trojan-PSW.Win32.Coins.nav

Link:

https://opentip.kaspersky.com/353b74e4fca84879a4f7406e1ab7972761bfec524b15294b9feab567b8d0744b/results?tab=lookup

Malware family:

AZORult

Verdict:

Malicious

Link:

https://analyze.intezer.com/analyses/0e47d16e-1ba2-4d4b-9fe9-d90dc3a4a6c2

Score:

97%

Verdict:

Malware

File Type:

Link:

https://malprob.io/report/353b74e4fca84879a4f7406e1ab7972761bfec524b15294b9feab567b8d0744b

Gathering data

Detection:

azorult

Link:

https://mwdb.cert.pl/sample/353b74e4fca84879a4f7406e1ab7972761bfec524b15294b9feab567b8d0744b/

Verdict:

Malicious

Threat:

Family.AZORULT

Link:

https://tip.neiki.dev/file/353b74e4fca84879a4f7406e1ab7972761bfec524b15294b9feab567b8d0744b

Threat name:

Win32.Trojan.AZORult

Status:

Malicious

First seen:

2026-03-06 17:24:34 UTC

File Type:

PE (Exe)

AV detection:

33 of 36 (91.67%)

Threat level:

5/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=gu5xjzh4vbehtjhxibxbvn4xe5q373csjmksss475k2wpogqorfq._file

Verdict:

malicious

Label(s):

azorult

AZORult

353b74e4fca84879a4f7406e1ab7972761bfec524b15294b9feab567b8d0744b

AZORult

473bfba1685fe3047cc582f18e36120c1b55449363834dbafcce003a89e5864c

AZORult

a3161c883a81cbe903b259ded89c4ff0130806583188a34b93bdaf2116a33e9e

AZORult

error

AZORult

+ 1'150 additional samples on MalwareBazaar

Result

Malware family:

azorult

Score:

10/10

Tags:

family:azorult collection credential_access defense_evasion discovery infostealer spyware stealer trojan

Link:

https://tria.ge/reports/260502-qmfwlag171/

Behaviour

Checks processor information in registry

Delays execution with timeout.exe

Suspicious behavior: EnumeratesProcesses

Suspicious use of WriteProcessMemory

outlook_office_path

outlook_win_path

Enumerates physical storage devices

System Location Discovery: System Language Discovery

Accesses Microsoft Outlook profiles

Accesses cryptocurrency files/wallets, possible credential harvesting

Checks installed software on the system

Checks computer location settings

Loads dropped DLL

Reads WinSCP keys stored on the system

Reads data files stored by FTP clients

Reads local data of messenger clients

Reads user/profile data of local email clients

Reads user/profile data of web browsers

Unsecured Credentials: Credentials In Files

Family: Azorult

Malware Config

C2 Extraction:

http://dnlg.eu.cc/8492015736.php

Unpacked files

SH256 hash:

353b74e4fca84879a4f7406e1ab7972761bfec524b15294b9feab567b8d0744b

MD5 hash:

6b12afb775ec4b8a046f79f79164b5a8

SHA1 hash:

04e23dced5030e6ed1be15829a50b912fd386391

Detections:

win_azorult_g1

Azorult

Link:

https://www.unpac.me/results/cde46637-d00a-4b71-84d3-32d77ca78886/

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/353b74e4fca84879a4f7406e1ab7972761bfec524b15294b9feab567b8d0744b

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	Azorult Create hunting rule
Author:	JPCERT/CC Incident Response Group
Description:	detect Azorult in memory
Reference:	internal research

Rule name:	Azorult Create hunting rule
Author:	kevoreilly
Description:	Azorult Payload

Rule name:	BobSoftMiniDelphiBoBBobSoft Create hunting rule
Author:	malware-lu

Rule name:	Borland Create hunting rule
Author:	malware-lu

Rule name:	EXE_Stealer_Azorult_March2024 Create hunting rule
Author:	Yashraj Solanki - Cyber Threat Intelligence Analyst at Bridewell

Rule name:	malware_Azorult Create hunting rule
Author:	JPCERT/CC Incident Response Group
Description:	detect Azorult in memory
Reference:	internal research

Rule name:	shellcode Create hunting rule
Author:	nex
Description:	Matched shellcode byte patterns

Rule name:	telebot_framework Create hunting rule
Author:	vietdx.mb

Rule name:	TH_AntiVM_MassHunt_Win_Malware_2026_CYFARE Create hunting rule
Author:	CYFARE
Description:	Detects Windows malware employing anti-VM / anti-sandbox evasion techniques across VMware, VirtualBox, Hyper-V, QEMU, Xen, and generic sandbox environments
Reference:	https://cyfare.net/

Rule name:	Trojan_W32_Gh0stMiancha_1_0_0 Create hunting rule

Rule name:	VECT_Ransomware Create hunting rule
Author:	Mustafa Bakhit
Description:	Detects activity associated with VECT ransomware. This includes registry modifications and deletions, execution of system and defense-evasion commands, suspicious API usage, mutex creation, file and memory manipulation, ransomware note generation, anti-debugging and anti-analysis techniques, and embedded cryptographic constants (SHA256) characteristic of this malware family. Designed for threat intelligence and malware detection environments.