MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 3a31af96c5d5bb68be19f9eeb3dc6c3dd09d9c51292f54b51cd6db0960c8a84a. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

AZORult

Vendor detections: 17

Intelligence 17 IOCs YARA 13 File information Comments

SHA256 hash:	3a31af96c5d5bb68be19f9eeb3dc6c3dd09d9c51292f54b51cd6db0960c8a84a
SHA3-384 hash:	3471feec2067dfaf3b503f1359c32b7788a65f27c90c6152727eb8a3e54a7e83fb01e7adc6b7de3ce9e3517d87222a81
SHA1 hash:	5719ab24c8b5f26d7443d7eb7580c0661002697c
MD5 hash:	3c870efbe2e2350a62697a545d491a30
humanhash:	washington-missouri-island-gee
File name:	SecuriteInfo.com.Win32.PWSX-gen.17580.24236
Download:	download sample
Signature	AZORult Create hunting rule
File size:	1'249'280 bytes
First seen:	2024-01-26 19:24:14 UTC
Last seen:	Never
File type:	exe
MIME type:	application/x-dosexec
imphash	f093bdfddcd6ca11531553576c65e93f (1 x SnakeKeylogger, 1 x AZORult)
ssdeep	24576:zfsGRdrEAbm4zusGRdrEAbm4zbL3AfemsGRdrEAbm4zNYZg4pLw:DbdYAm4zubdYAm4z/3AXbdYAm4zNYZ1w
TLSH	T12645BF027B50A671D4A76F38AF2EC0806B3BBD76A662070B336B73651E757834C57239
TrID	62.2% (.EXE) Win32 Executable MS Visual C++ 5.0 (60687/85) 10.7% (.EXE) Win64 Executable (generic) (10523/12/4) 6.7% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2) 5.1% (.EXE) Win16 NE executable (generic) (5038/12/1) 4.6% (.EXE) Win32 Executable (generic) (4505/5/1)
File icon (PE):
dhash icon	1003873d31213f10 (149 x DarkCloud, 146 x a310Logger, 132 x GuLoader)
Reporter	SecuriteInfoCom
Tags:	AZORult exe

Intelligence

File Origin

# of uploads :

# of downloads :

334

Origin country :

Vendor Threat Intelligence

Malware family:

azorult

ID:

File name:

sa.com.zip

Verdict:

Malicious activity

Analysis date:

2024-01-26 20:30:04 UTC

Tags:

snake keylogger evasion azorult

Link:

https://app.any.run/tasks/1ded95e2-11dd-4350-a7db-ba78dbf9a10d

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

Detection:

Azorult

Link:

https://www.capesandbox.com/analysis/473105/

Detection(s):

SecuriteInfo.com.Win32.PWSX-gen.17580.24236.UNOFFICIAL

Result

Verdict:

Malware

Maliciousness:

Behaviour

Searching for the window

Сreating synchronization primitives

Creating a window

Sending a custom TCP request

Verdict:

Malicious

Threat level:

10/10

Confidence:

100%

Tags:

crypto

Link:

https://www.filescan.io/uploads/65b407130eab2d1605439c53/reports/f55fb30a-19db-4a25-a970-b28d3cbdf475/overview

Verdict:

Malicious

Labled as:

Fragtor.Generic

Link:

https://www.hybrid-analysis.com/sample/3a31af96c5d5bb68be19f9eeb3dc6c3dd09d9c51292f54b51cd6db0960c8a84a

Malware family:

AZORult

Verdict:

Malicious

Link:

https://analyze.intezer.com/analyses/4d7d0e5c-1b3b-4335-addf-01b5f95c43c4

Result

Threat name:

AZORult

Detection:

malicious

Classification:

phis.troj.spyw.evad

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/1381884

Signature

Antivirus / Scanner detection for submitted sample

Antivirus detection for URL or domain

C2 URLs / IPs found in malware configuration

Contains functionality to detect sleep reduction / modifications

Detected AZORult Info Stealer

Detected unpacking (changes PE section rights)

Found malware configuration

Found many strings related to Crypto-Wallets (likely being stolen)

Malicious sample detected (through community Yara rule)

Maps a DLL or memory area into another process

Multi AV Scanner detection for submitted file

Tries to detect sandboxes and other dynamic analysis tools (window names)

Tries to harvest and steal Bitcoin Wallet information

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal ftp login credentials

Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)

Tries to steal Crypto Currency Wallets

Tries to steal Instant Messenger accounts or passwords

Tries to steal Mail credentials (via file / registry access)

Yara detected Azorult

Yara detected Azorult Info Stealer

Behaviour

Behavior Graph:

Download SVG

Score:

99%

Verdict:

Malware

File Type:

Link:

https://malprob.io/report/3a31af96c5d5bb68be19f9eeb3dc6c3dd09d9c51292f54b51cd6db0960c8a84a

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/3a31af96c5d5bb68be19f9eeb3dc6c3dd09d9c51292f54b51cd6db0960c8a84a/

Threat name:

Win32.Spyware.Azorult

Status:

Malicious

First seen:

2024-01-25 19:01:25 UTC

File Type:

PE (Exe)

Extracted files:

AV detection:

22 of 38 (57.89%)

Threat level:

2/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=hiy27fwf2w5wrpqz7hxlhxdmhxij3hcrfexvjni423nqsygivbfa._file

Verdict:

malicious

Label(s):

azorult

Result

Malware family:

azorult

Score:

10/10

Tags:

family:azorult collection discovery infostealer spyware stealer trojan

Link:

https://tria.ge/reports/240126-x4yajaebbm/

Behaviour

Checks processor information in registry

Suspicious behavior: EnumeratesProcesses

Suspicious behavior: MapViewOfSection

Suspicious use of SetWindowsHookEx

Suspicious use of WriteProcessMemory

outlook_office_path

outlook_win_path

Suspicious use of SetThreadContext

Accesses Microsoft Outlook profiles

Accesses cryptocurrency files/wallets, possible credential harvesting

Checks installed software on the system

Loads dropped DLL

Reads data files stored by FTP clients

Reads local data of messenger clients

Reads user/profile data of local email clients

Reads user/profile data of web browsers

Azorult

Malware Config

C2 Extraction:

https://5desconcertais.sa.com/cn/nem/index.php

Unpacked files

SH256 hash:

6b2106384e744826b345656845fe096b4f09f77ed9be11137a59ba8b77f6bfdc

MD5 hash:

60328699ae62d1304c19f468ff971cc3

SHA1 hash:

c52cd93b79aec761d1e47a965b616117eee2bbfd

Detections:

Azorult

win_azorult_auto

win_azorult_g1

Link:

https://www.unpac.me/results/ae1ea124-ce70-402a-ae0b-426f0f14933a/

SH256 hash:

3a31af96c5d5bb68be19f9eeb3dc6c3dd09d9c51292f54b51cd6db0960c8a84a

MD5 hash:

3c870efbe2e2350a62697a545d491a30

SHA1 hash:

5719ab24c8b5f26d7443d7eb7580c0661002697c

Link:

https://www.unpac.me/results/ae1ea124-ce70-402a-ae0b-426f0f14933a/

Malware family:

AZORult

Verdict:

Malicious

Link:

https://www.vmray.com/analyses/_mb/3a31af96c5d5/report/overview.html

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/3a31af96c5d5bb68be19f9eeb3dc6c3dd09d9c51292f54b51cd6db0960c8a84a

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	Azorult Create hunting rule
Author:	kevoreilly
Description:	Azorult Payload

Rule name:	BobSoftMiniDelphiBoBBobSoft Create hunting rule
Author:	malware-lu

Rule name:	Borland Create hunting rule
Author:	malware-lu

Rule name:	DebuggerCheck__RemoteAPI Create hunting rule
Reference:	https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara

Rule name:	maldoc_find_kernel32_base_method_1 Create hunting rule
Author:	Didier Stevens (https://DidierStevens.com)

Rule name:	maldoc_getEIP_method_1 Create hunting rule
Author:	Didier Stevens (https://DidierStevens.com)

Rule name:	meth_get_eip Create hunting rule
Author:	Willi Ballenthin

Rule name:	SEH__vba Create hunting rule
Reference:	https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara

Rule name:	shellcode Create hunting rule
Author:	nex
Description:	Matched shellcode byte patterns

Rule name:	Trojan_W32_Gh0stMiancha_1_0_0 Create hunting rule

Rule name:	Windows_Trojan_Azorult_38fce9ea Create hunting rule
Author:	Elastic Security

Rule name:	win_azorult_auto Create hunting rule
Author:	Felix Bilstein - yara-signator at cocacoding dot com
Description:	Detects win.azorult.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape

https://www.capesandbox.com/analysis/473105/

Comments

Login required

You need to login to in order to write a comment. Login with your abuse.ch account.

No comments found for this malware sample