🤲🏼 NEW | abuse.ch Community Hub! Earn recognition 🏅 for the malware intelligence you share, climb the leaderboards 📈, and connect with like-minded contributors who share your hunting focus 🤝. Ready to unlock your profile? Go to the Community Hub →

MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 4130ce135fbfab00618f261a0397e88479d2f61e1ed0d09ebcde525439774f3e. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AZORult


Vendor detections: 13


Intelligence 13 IOCs YARA 4 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 4130ce135fbfab00618f261a0397e88479d2f61e1ed0d09ebcde525439774f3e
SHA3-384 hash: b0099a7dd1daa832764f8ff01ae3617e9d770de089d90f185882d5c7f2c053a9336cc8bc0d9a3694b51c5e33f228c53b
SHA1 hash: 99e978ac35c3a33b075c4dbdab1e175c361e2396
MD5 hash: e5e6dc2c08d6d34b5427ca50ecba3431
humanhash: uniform-colorado-seventeen-hawaii
File name:file
Download: download sample
Signature AZORult
Create hunting rule
File size:7'525'376 bytes
First seen:2023-04-10 14:43:05 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (49'234 x AgentTesla, 20'488 x Formbook, 12'372 x SnakeKeylogger)
ssdeep 49152:A1H4VI6/UGwPVGv8i5aU0Bc21/K2Xd8nGozc30kaZt3DJIHo1fmHp+d2Zcxb2W7k:TD8GwVAn29XbozcEX7
TLSH T1C2765CE613D66994D2BB2A32A0B532058F64E8234B5DFB17708CA1FF1F66F116D12723
TrID 63.0% (.EXE) Generic CIL Executable (.NET, Mono, etc.) (73123/4/13)
11.2% (.SCR) Windows screen saver (13097/50/3)
9.0% (.EXE) Win64 Executable (generic) (10523/12/4)
5.6% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
3.8% (.EXE) Win32 Executable (generic) (4505/5/1)
Reporter jstrosch
Tags:.NET AZORult exe MSIL

Intelligence

File Origin
# of uploads :
1
# of downloads :
391
Origin country :
US US
Vendor Threat Intelligence
Malware family:
remcos
Create hunting rule
ID:
1
File name:
file
Verdict:
Malicious activity
Analysis date:
2023-04-10 14:47:02 UTC
Tags:
rhadamanthys loader remcos trojan rat azorult
Link:
https://app.any.run/tasks/6cf7ad56-f113-4243-9f1d-045c67cad1b6

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
Rhadamanthys
Create hunting rule
Link:
https://www.capesandbox.com/analysis/381228/
Detection(s):
SecuriteInfo.com.Trojan.GenericKD.66331751.26135.1637.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Unauthorized injection to a recently created process
Creating a file
Сreating synchronization primitives
DNS request
Sending an HTTP GET request
Launching a process
Reading critical registry keys
Searching for the window
Connecting to a non-recommended domain
Creating a file in the %temp% directory
Creating a file in the %AppData% directory
Stealing user critical data
Unauthorized injection to a system process
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
obfuscated packed
Link:
https://www.filescan.io/uploads/643420b340ffb6ba5fad0fcc/reports/c31fdd2e-67af-421a-a42e-05448bbcfabc/overview
Verdict:
Malicious
Labled as:
Win/malicious_confidence_100%
Link:
https://www.hybrid-analysis.com/sample/4130ce135fbfab00618f261a0397e88479d2f61e1ed0d09ebcde525439774f3e
Verdict:
Unknown
Link:
https://analyze.intezer.com/analyses/62c7557e-4955-4520-8396-948489db2d49
Result
Threat name:
RHADAMANTHYS, Remcos
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.expl.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1211154
Signature
Allocates memory in foreign processes
C2 URLs / IPs found in malware configuration
Connects to many ports of the same IP (likely port scanning)
Creates processes via WMI
Early bird code injection technique detected
Encrypted powershell cmdline option found
Found many strings related to Crypto-Wallets (likely being stolen)
Hides threads from debuggers
Injects a PE file into a foreign processes
Installs a global keyboard hook
Machine Learning detection for dropped file
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
Maps a DLL or memory area into another process
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Queues an APC in another process (thread injection)
Snort IDS alert for network traffic
System process connects to network (likely due to code injection or exploit)
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Tries to harvest and steal browser information (history, passwords, etc)
Writes to foreign memory regions
Yara detected AntiVM3
Yara detected Remcos RAT
Yara detected RHADAMANTHYS Stealer
Yara detected UAC Bypass using CMSTP
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 844075 Sample: file.exe Startdate: 10/04/2023 Architecture: WINDOWS Score: 100 73 turkie.ac.ug 2->73 75 platitinas.ac.ug 2->75 77 3 other IPs or domains 2->77 97 Snort IDS alert for network traffic 2->97 99 Malicious sample detected (through community Yara rule) 2->99 101 Multi AV Scanner detection for submitted file 2->101 103 9 other signatures 2->103 12 file.exe 1 2->12         started        16 WmiPrvSE.exe 2->16         started        18 Hwjqncovk.exe 2->18         started        20 WmiPrvSE.exe 2->20         started        signatures3 process4 file5 69 C:\Users\user\AppData\Local\...\file.exe.log, ASCII 12->69 dropped 121 Injects a PE file into a foreign processes 12->121 22 file.exe 12->22         started        26 file.exe 12->26         started        28 B31E.tmp.exe 16->28         started        30 CC83.tmp.exe 16->30         started        123 Multi AV Scanner detection for dropped file 18->123 125 Machine Learning detection for dropped file 18->125 signatures6 process7 dnsIp8 81 perfecto.ac.ug 22->81 105 Writes to foreign memory regions 22->105 107 Allocates memory in foreign processes 22->107 109 Hides threads from debuggers 22->109 32 dllhost.exe 4 22->32         started        111 Multi AV Scanner detection for dropped file 28->111 113 Machine Learning detection for dropped file 28->113 signatures9 process10 dnsIp11 71 perfecto.ac.ug 32->71 59 C:\Users\user\AppData\Local\...\CC83.tmp.exe, PE32 32->59 dropped 61 C:\Users\user\AppData\Local\...\B31E.tmp.exe, PE32 32->61 dropped 63 C:\Users\user\AppData\Local\...\A68.tmp.exe, PE32+ 32->63 dropped 89 System process connects to network (likely due to code injection or exploit) 32->89 91 Early bird code injection technique detected 32->91 93 Tries to harvest and steal browser information (history, passwords, etc) 32->93 95 3 other signatures 32->95 37 dllhost.exe 7 5 32->37         started        file12 signatures13 process14 dnsIp15 79 turkie.ac.ug 37->79 65 C:\Users\user\AppData\Roaming\rem.exe, PE32 37->65 dropped 41 rem.exe 1 4 37->41         started        file16 process17 file18 67 C:\Users\user\AppData\...\Hwjqncovk.exe, PE32 41->67 dropped 115 Multi AV Scanner detection for dropped file 41->115 117 Machine Learning detection for dropped file 41->117 119 Injects a PE file into a foreign processes 41->119 45 rem.exe 3 3 41->45         started        49 cmd.exe 1 41->49         started        51 rem.exe 41->51         started        53 rem.exe 41->53         started        signatures19 process20 dnsIp21 83 marcapinyo.ug 37.0.14.204, 49705, 49706, 49707 WKD-ASIE Netherlands 45->83 85 platitinas.ac.ug 45->85 87 2 other IPs or domains 45->87 127 Installs a global keyboard hook 45->127 129 Encrypted powershell cmdline option found 49->129 55 powershell.exe 22 49->55         started        57 conhost.exe 49->57         started        signatures22 process23
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/4130ce135fbfab00618f261a0397e88479d2f61e1ed0d09ebcde525439774f3e/
Threat name:
ByteCode-MSIL.Spyware.Rhadamanthys
Create hunting rule
Status:
Suspicious
First seen:
2023-04-07 19:57:26 UTC
File Type:
PE (.Net Exe)
Extracted files:
28
AV detection:
18 of 24 (75.00%)
Threat level:
  2/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=ieym4e27x6vqaympeynahf7iqr45f5q6d3inbhv43zjfiolxj47a._file
Result
Malware family:
rhadamanthys
Create hunting rule
Score:
  10/10
Tags:
family:azorult family:rhadamanthys collection infostealer persistence stealer trojan
Link:
https://tria.ge/reports/230410-r35qbsag99/
Behaviour
Checks processor information in registry
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: MapViewOfSection
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
outlook_office_path
outlook_win_path
Enumerates physical storage devices
Suspicious use of NtSetInformationThreadHideFromDebugger
Suspicious use of SetThreadContext
Accesses Microsoft Outlook profiles
Adds Run key to start application
Checks computer location settings
Executes dropped EXE
Azorult
Detect rhadamanthys stealer shellcode
Rhadamanthys
Malware Config
C2 Extraction:
http://195.245.112.115/index.php
Unpacked files
SH256 hash:
ff8c24bce1eb009f0d5c47a09b96caf02726c285cea0d635082ad4da27e63d1b
MD5 hash:
9d6ec6072ee1814a4a01d1eb3fb67ba1
SHA1 hash:
d0b416de1c900b6bcb35dc182b2e8744f16c3289
Link:
https://www.unpac.me/results/57407d78-353c-495f-8499-2c743674e14d/
SH256 hash:
0e94e5712d93d43423f3fec2f3a7f2b859d749411034c839c13e428f651f11a6
MD5 hash:
a0f31a66b6f4c65af35c8fe20b900f06
SHA1 hash:
7233d573e3477d10d32b334cb1b099c74340eebf
Link:
https://www.unpac.me/results/57407d78-353c-495f-8499-2c743674e14d/
SH256 hash:
ccf190de82033952e31857ee5055df8e76a0bbd067d51e44b973d4394ca9e303
MD5 hash:
25dde007a8f79065e04d9ccae453a46c
SHA1 hash:
621c9555c02614986869548ed2389d85f44ca549
Link:
https://www.unpac.me/results/57407d78-353c-495f-8499-2c743674e14d/
SH256 hash:
4130ce135fbfab00618f261a0397e88479d2f61e1ed0d09ebcde525439774f3e
MD5 hash:
e5e6dc2c08d6d34b5427ca50ecba3431
SHA1 hash:
99e978ac35c3a33b075c4dbdab1e175c361e2396
Link:
https://www.unpac.me/results/57407d78-353c-495f-8499-2c743674e14d/
Malware family:
Remcos
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/4130ce135fbf/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/4130ce135fbfab00618f261a0397e88479d2f61e1ed0d09ebcde525439774f3e

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:BitcoinAddress
Create hunting rule
Author:Didier Stevens (@DidierStevens)
Description:Contains a valid Bitcoin address
Rule name:INDICATOR_EXE_Packed_SmartAssembly
Create hunting rule
Author:ditekSHen
Description:Detects executables packed with SmartAssembly
Rule name:pe_imphash
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

AZORult

Executable exe 4130ce135fbfab00618f261a0397e88479d2f61e1ed0d09ebcde525439774f3e

(this sample)

  
Delivery method
Distributed via web download
  
URLhaus
https://urlhaus.abuse.ch/url/2254175/
  
URLhaus
https://urlhaus.abuse.ch/url/265919/
  
URLhaus
https://urlhaus.abuse.ch/url/2141170/
  
URLhaus
https://urlhaus.abuse.ch/url/2271066/
  
URLhaus
https://urlhaus.abuse.ch/url/906880/
  
URLhaus
https://urlhaus.abuse.ch/url/2506772/
  
URLhaus
https://urlhaus.abuse.ch/url/1514297/
  
URLhaus
https://urlhaus.abuse.ch/url/1539152/
  
URLhaus
https://urlhaus.abuse.ch/url/1514315/
  
URLhaus
https://urlhaus.abuse.ch/url/2257580/
  
URLhaus
https://urlhaus.abuse.ch/url/1514313/
  
URLhaus
https://urlhaus.abuse.ch/url/2271067/
  
URLhaus
https://urlhaus.abuse.ch/url/1596393/
  
URLhaus
https://urlhaus.abuse.ch/url/1514098/
  
URLhaus
https://urlhaus.abuse.ch/url/2257588/
  
URLhaus
https://urlhaus.abuse.ch/url/1539388/
  
URLhaus
https://urlhaus.abuse.ch/url/2441296/
  
URLhaus
https://urlhaus.abuse.ch/url/2254174/
  
URLhaus
https://urlhaus.abuse.ch/url/2578024/
  
URLhaus
https://urlhaus.abuse.ch/url/2254177/
  
URLhaus
https://urlhaus.abuse.ch/url/2577943/
Cape
Cape
https://www.capesandbox.com/analysis/381228/

Comments