🤲🏼 NEW | abuse.ch Community Hub! Earn recognition 🏅 for the malware intelligence you share, climb the leaderboards 📈, and connect with like-minded contributors who share your hunting focus 🤝. Ready to unlock your profile? Go to the Community Hub →

MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 3618a9475bc85cf9ac8ad4aa0224ce4e3d38d1f0b5edad9ce6c30eb8ba88b695. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AZORult


Vendor detections: 7


Intelligence 7 IOCs 1 YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 3618a9475bc85cf9ac8ad4aa0224ce4e3d38d1f0b5edad9ce6c30eb8ba88b695
SHA3-384 hash: 9114825ff3c9cfea8018cc4a515a1791475fd9d67781011bda50f7f8af8a01b08683fd3962203e13a5ed6fd201724125
SHA1 hash: 202aac102fd7189aa215a4307d0b42f8937cfd75
MD5 hash: 93139d04c79b7a3a43d820bc31047c04
humanhash: winner-zebra-fourteen-mango
File name:3618a9475bc85cf9ac8ad4aa0224ce4e3d38d1f0b5edad9ce6c30eb8ba88b695
Download: download sample
Signature AZORult
Create hunting rule
File size:530'592 bytes
First seen:2024-11-25 14:27:56 UTC
Last seen:Never
File type: rar
MIME type:application/x-rar
ssdeep 12288:fwiWxK0KwJFOkxHE0MrdTuqxxRV2ncMueOfwqWJycij2WlG6rqMh4g1Ojwp:RKKX4Op0qHxQcRfdcijxllmS+wp
TLSH T190B423144DB94FFE21F15C809B4519D03398BA39846FEA92526F33BD83607B1E632CA5
TrID 61.5% (.RAR) RAR compressed archive (v5.0) (8000/1)
38.4% (.RAR) RAR compressed archive (gen) (5000/1)
Magika rar
Reporter JAMESWT_WT
Tags:89-40-31-232 AZORult rar

Indicators Of Compromise (IOCs)

Below is a list of indicators of compromise (IOCs) associated with this malware samples.

IOCThreatFox Reference
http://89.40.31.232/12/index.php https://threatfox.abuse.ch/ioc/1340968/

Intelligence

File Origin
# of uploads :
1
# of downloads :
137
Origin country :
IT IT
File Archive Information

This file archive contains 1 file(s), sorted by their relevance:

File name:Dekont#400577_89008_96634.exe
File size:656'515 bytes
SHA256 hash: ffb9748a0ed7684161780e27a733f2ab11071515cc27905767813a32c8c308ff
MD5 hash: 1d14f171fd8a6a070150c81abed8b966
MIME type:application/x-dosexec
Signature AZORult
Vendor Threat Intelligence
Verdict:
Malicious
Score:
94.9%
Link:
https://cyber-fortress.com/docs/result/index.php?id=6728e87f8d23d904913367ab
Tags:
injection exploit
Gathering data
Verdict:
Suspicious
Labled as:
Mal/DrodRar
Link:
https://www.hybrid-analysis.com/sample/3618a9475bc85cf9ac8ad4aa0224ce4e3d38d1f0b5edad9ce6c30eb8ba88b695
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/3618a9475bc85cf9ac8ad4aa0224ce4e3d38d1f0b5edad9ce6c30eb8ba88b695/
Threat name:
Win32.Trojan.Guloader
Create hunting rule
Status:
Malicious
First seen:
2024-11-25 14:26:52 UTC
File Type:
Binary (Archive)
Extracted files:
7
AV detection:
19 of 38 (50.00%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=gymksr23zboptlek2svaejgojy6trupqwxw23hhgymhlrouiw2kq._file
Result
Malware family:
azorult
Create hunting rule
Score:
  10/10
Tags:
family:azorult discovery infostealer trojan
Link:
https://tria.ge/reports/241125-rwva1s1mgy/
Behaviour
Suspicious behavior: MapViewOfSection
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
System Location Discovery: System Language Discovery
Drops file in Program Files directory
Drops file in Windows directory
Suspicious use of NtCreateThreadExHideFromDebugger
Suspicious use of NtSetInformationThreadHideFromDebugger
Suspicious use of SetThreadContext
Legitimate hosting services abused for malware hosting/C2
Loads dropped DLL
Azorult
Azorult family
Malware Config
C2 Extraction:
http://89.40.31.232/12/index.php
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Azorult
Score:
0.90
Link:
https://yomi.yoroi.company/submissions/3618a9475bc85cf9ac8ad4aa0224ce4e3d38d1f0b5edad9ce6c30eb8ba88b695

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:Sus_Obf_Enc_Spoof_Hide_PE
Create hunting rule
Author:XiAnzheng
Description:Check for Overlay, Obfuscating, Encrypting, Spoofing, Hiding, or Entropy Technique(can create FP)

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Comments