MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 4b7533cc2e9aec7f323dd6ffcecb19082611085adab4cede0cdde320f4032fff. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	4b7533cc2e9aec7f323dd6ffcecb19082611085adab4cede0cdde320f4032fff
SHA3-384 hash:	849954d7254783ad17e7c713a05c75b01ef7feeabaa60698672960bd84fdd3c483d1a48a40834686ea5d2a08e39bb667
SHA1 hash:	a2e7f8635ceddaad4530f37816f7872d41a77e13
MD5 hash:	e860f118877cd4ded94fc418a2b407d8
humanhash:	undress-delta-bulldog-double
File name:	CmR9157001.exe
Download:	download sample
Signature	AZORult Alert Create hunting rule
File size:	541'023 bytes
First seen:	2023-12-03 15:15:05 UTC
Last seen:	Never
File type:	exe
MIME type:	application/x-dosexec
imphash	1f23f452093b5c1ff091a2f9fb4fa3e9 (303 x GuLoader, 47 x AgentTesla, 47 x RemcosRAT)
ssdeep	12288:jn0T3W6EmXJtI+XsNc+wKGKDslIntbD8AtgWDxLua:j0T3WbOt/sWIDXtcKx1
TLSH	T1DBB4AC13724E5283DB625270DA2FC395A75DEC11BF60E397FF142AABDE620815CE7212
TrID	47.3% (.EXE) Win32 Executable MS Visual C++ (generic) (31206/45/13) 15.9% (.EXE) Win64 Executable (generic) (10523/12/4) 9.9% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2) 7.6% (.EXE) Win16 NE executable (generic) (5038/12/1) 6.8% (.EXE) Win32 Executable (generic) (4505/5/1)
File icon (PE):
dhash icon	98585adad8d83eae (1 x AZORult)
Reporter	TeamDreier
Tags:	AZORult exe

Intelligence

---

File Origin

# of uploads :

1

# of downloads :

315

Origin country :

DK

Vendor Threat Intelligence

CAPE Sandbox

Detection:

n/a

Link:

https://www.capesandbox.com/analysis/462106/

ClamAV Detected

Detection(s):

SecuriteInfo.com.NSIS.InjectorX-gen.28599.9.UNOFFICIAL

Alert

Create hunting rule

Dr. Web vxCube Malware

Result

Verdict:

Malware

Maliciousness:

Behaviour

Searching for the window

Creating a file in the %temp% directory

Creating a window

Creating a file in the %AppData% subdirectories

Creating a process from a recently created file

Sending a custom TCP request

Launching a process

Dragonfly

Gathering data

FileScan.IO Likely Malicious

Verdict:

Likely Malicious

Threat level:

  7.5/10

Confidence:

100%

Tags:

control installer lolbin overlay packed shell32

Link:

https://www.filescan.io/uploads/656c9bcf6d4756846dc6ec6f/reports/a5799180-db1b-4f08-99f5-426ba1f3e0e6/overview

Hybrid Analysis Win/grayware_confidence_60%

Verdict:

Malicious

Labled as:

Win/grayware_confidence_60%

Link:

https://www.hybrid-analysis.com/sample/4b7533cc2e9aec7f323dd6ffcecb19082611085adab4cede0cdde320f4032fff

Intezer Malicious

Verdict:

Malicious

Link:

https://analyze.intezer.com/analyses/c89edd7a-37a9-4b54-9657-5990123b123d

Joe Sandbox GuLoader

Result

Threat name:

GuLoader

Alert

Create hunting rule

Detection:

malicious

Classification:

troj.evad

Score:

88 / 100

Link:

https://www.joesandbox.com/analysis/1352617

Signature

Antivirus detection for URL or domain

Found suspicious powershell code related to unpacking or dynamic code loading

Maps a DLL or memory area into another process

Multi AV Scanner detection for submitted file

Obfuscated command line found

Suspicious powershell command line found

Very long command line found

Writes to foreign memory regions

Yara detected GuLoader

Behaviour

Behavior Graph:

Download SVG

Nucleon Malprob Malware

Score:

95%

Verdict:

Malware

File Type:

PE

Link:

https://malprob.io/report/4b7533cc2e9aec7f323dd6ffcecb19082611085adab4cede0cdde320f4032fff

CERT.PL MWDB

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/4b7533cc2e9aec7f323dd6ffcecb19082611085adab4cede0cdde320f4032fff/

ReversingLabs TitaniumCloud Win32.Trojan.Guloader

Threat name:

Win32.Trojan.Guloader

Alert

Create hunting rule

Status:

Malicious

First seen:

2023-11-29 00:31:19 UTC

File Type:

PE (Exe)

Extracted files:

9

AV detection:

21 of 37 (56.76%)

Threat level:

  5/5

Spamhaus Hash Blocklist Malicious file

Detection(s):

Malicious file

Link:

https://check.spamhaus.org/check/?searchterm=jn2thtbotlwh6mr523745syzbatbccc23k2m5xqm3xrsb5adf77q._file

Threatray cloudeye

Verdict:

malicious

Label(s):

cloudeye

Alert

Create hunting rule

Hatching Triage guloader

Result

Malware family:

guloader

Alert

Create hunting rule

Score:

  10/10

Tags:

family:guloader downloader

Link:

https://tria.ge/reports/231203-snfy4acd52/

Behaviour

Suspicious behavior: EnumeratesProcesses

Suspicious behavior: MapViewOfSection

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

Enumerates physical storage devices

Drops file in Program Files directory

Drops file in Windows directory

Drops file in System32 directory

Suspicious use of NtSetInformationThreadHideFromDebugger

Suspicious use of SetThreadContext

Guloader,Cloudeye

UnpacMe

Unpacked files

SH256 hash:

4b7533cc2e9aec7f323dd6ffcecb19082611085adab4cede0cdde320f4032fff

MD5 hash:

e860f118877cd4ded94fc418a2b407d8

SHA1 hash:

a2e7f8635ceddaad4530f37816f7872d41a77e13

Link:

https://www.unpac.me/results/d65090ad-4bea-4d5e-86c4-0f61eb528ccb/

VMRay Malicious

Verdict:

Malicious

Link:

https://www.vmray.com/analyses/_mb/4b7533cc2e9a/report/overview.html

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

YOROI YOMI Azorult

Threat name:

Azorult

Score:

0.90

Link:

https://yomi.yoroi.company/submissions/4b7533cc2e9aec7f323dd6ffcecb19082611085adab4cede0cdde320f4032fff

File information

---

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AZORult

exe 4b7533cc2e9aec7f323dd6ffcecb19082611085adab4cede0cdde320f4032fff

(this sample)

  

Delivery method

Distributed via e-mail attachment

Cape

https://www.capesandbox.com/analysis/462106/