🤲🏼 NEW | abuse.ch Community Hub! Earn recognition 🏅 for the malware intelligence you share, climb the leaderboards 📈, and connect with like-minded contributors who share your hunting focus 🤝. Ready to unlock your profile? Go to the Community Hub →

MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 52dd1ddf925baa01a172d0e420ec8833a10726ee7a7dcfc2a55f1e04f47c6a63. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AZORult


Vendor detections: 10


Intelligence 10 IOCs YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 52dd1ddf925baa01a172d0e420ec8833a10726ee7a7dcfc2a55f1e04f47c6a63
SHA3-384 hash: 154a7a84f38d7c9dc2bee43736392e35d12ca8f81b0a0ba138bfe19094f8e65df621087bace231879f03e98067329eca
SHA1 hash: 77a26b80323ac8e1f172d8ce980120454ed53939
MD5 hash: 5ad5fcac5705acde3ed51ae6b3c2c0b1
humanhash: dakota-mockingbird-indigo-idaho
File name:DOC6010038709-PO.exe
Download: download sample
Signature AZORult
Create hunting rule
File size:411'480 bytes
First seen:2024-01-22 16:40:22 UTC
Last seen:2024-01-22 18:28:08 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash e2a592076b17ef8bfb48b7e03965a3fc (419 x GuLoader, 63 x RemcosRAT, 52 x AgentTesla)
ssdeep 12288:3kvqcSBHwEbBn+mDZVKxRu2GfWLpcCoJt:9wOTZVKbgWLCCat
TLSH T11794E0003750E55AD5ED1A744CBFD2FE1E74AE432E61820BE380FF4E3972AC1B949669
TrID 47.3% (.EXE) Win32 Executable MS Visual C++ (generic) (31206/45/13)
15.9% (.EXE) Win64 Executable (generic) (10523/12/4)
9.9% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
7.6% (.EXE) Win16 NE executable (generic) (5038/12/1)
6.8% (.EXE) Win32 Executable (generic) (4505/5/1)
File icon (PE):PE icon
dhash icon d0c0ccfcf6daac46 (5 x AZORult, 3 x GuLoader, 2 x AgentTesla)
Reporter abuse_ch
Tags:AZORult exe signed

Code Signing Certificate

Organisation:Forbigaaelsens
Issuer:Forbigaaelsens
Algorithm:sha256WithRSAEncryption
Valid from:2023-07-01T05:07:18Z
Valid to:2026-06-30T05:07:18Z
Serial number: 3fba213a944d93f867a0afb8c96f16c133371435
Thumbprint Algorithm:SHA256
Thumbprint: d37807568dceaa4f64fdca220465d9e6b4d669e097ebc1e7cd685967d1c71e16
Source:This information was brought to you by ReversingLabs A1000 Malware Analysis Platform


Avatar
abuse_ch
AZORult C2:
http://lbxl.shop/LB341/index.php

Intelligence

File Origin
# of uploads :
2
# of downloads :
391
Origin country :
NL NL
Vendor Threat Intelligence
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/472334/
Detection(s):
SecuriteInfo.com.NSIS.MalwareX-gen.23672.24420.UNOFFICIAL
Create hunting rule

Result
Verdict:
Clean
Maliciousness:

Behaviour
Creating a window
Searching for the window
Creating a file
Creating a file in the %temp% subdirectories
Searching for the Windows task manager window
Verdict:
No Threat
Threat level:
  10/10
Confidence:
100%
Tags:
installer lolbin overlay packed shell32
Link:
https://www.filescan.io/uploads/65ae9aa0f3cf17c17b75c26a/reports/60f0bbcf-3725-4931-9db7-aa57fa44482f/overview
Verdict:
Malicious
Labled as:
Win/malicious_confidence_90%
Link:
https://www.hybrid-analysis.com/sample/52dd1ddf925baa01a172d0e420ec8833a10726ee7a7dcfc2a55f1e04f47c6a63
Verdict:
Suspicious
Link:
https://analyze.intezer.com/analyses/517f0140-5ca0-4d28-9cf0-fa91644d640b
Result
Threat name:
GuLoader, Azorult
Create hunting rule
Detection:
malicious
Classification:
troj.evad.phis.spyw
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1378909
Signature
Antivirus / Scanner detection for submitted sample
Creates files with lurking names (e.g. Crack.exe)
Found many strings related to Crypto-Wallets (likely being stolen)
Malicious sample detected (through community Yara rule)
Maps a DLL or memory area into another process
Self deletion via cmd or bat file
Snort IDS alert for network traffic
Tries to harvest and steal Bitcoin Wallet information
Tries to harvest and steal browser information (history, passwords, etc)
Tries to harvest and steal ftp login credentials
Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)
Tries to steal Crypto Currency Wallets
Tries to steal Instant Messenger accounts or passwords
Tries to steal Mail credentials (via file / registry access)
Yara detected Azorult
Yara detected GuLoader
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1378909 Sample: DOC6010038709-PO.exe Startdate: 22/01/2024 Architecture: WINDOWS Score: 100 38 lbxl.shop 2->38 40 aiv.mk 2->40 46 Snort IDS alert for network traffic 2->46 48 Malicious sample detected (through community Yara rule) 2->48 50 Antivirus / Scanner detection for submitted sample 2->50 52 2 other signatures 2->52 9 DOC6010038709-PO.exe 8 48 2->9         started        signatures3 process4 file5 24 C:\Users\user\AppData\Local\...\nsExec.dll, PE32 9->24 dropped 26 C:\Users\user\AppData\Local\...\nsDialogs.dll, PE32 9->26 dropped 28 C:\Users\user\AppData\Local\...\System.dll, PE32 9->28 dropped 54 Self deletion via cmd or bat file 9->54 56 Creates files with lurking names (e.g. Crack.exe) 9->56 58 Maps a DLL or memory area into another process 9->58 13 DOC6010038709-PO.exe 63 9->13         started        signatures6 process7 dnsIp8 42 lbxl.shop 104.21.19.203, 50134, 50135, 80 CLOUDFLARENETUS United States 13->42 44 aiv.mk 95.156.8.108, 443, 50133 MT-AS-OWNbulOrceNikolovbbMK Macedonia 13->44 30 C:\Users\user\AppData\...\vcruntime140.dll, PE32 13->30 dropped 32 C:\Users\user\AppData\Local\...\ucrtbase.dll, PE32 13->32 dropped 34 C:\Users\user\AppData\Local\...\softokn3.dll, PE32 13->34 dropped 36 45 other files (none is malicious) 13->36 dropped 60 Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc) 13->60 62 Tries to steal Instant Messenger accounts or passwords 13->62 64 Tries to steal Mail credentials (via file / registry access) 13->64 66 6 other signatures 13->66 18 cmd.exe 1 13->18         started        file9 signatures10 process11 process12 20 conhost.exe 18->20         started        22 timeout.exe 1 18->22         started       
Score:
99%
Verdict:
Malware
File Type:
PE
Link:
https://malprob.io/report/52dd1ddf925baa01a172d0e420ec8833a10726ee7a7dcfc2a55f1e04f47c6a63
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/52dd1ddf925baa01a172d0e420ec8833a10726ee7a7dcfc2a55f1e04f47c6a63/
Threat name:
Win32.Trojan.Generic
Create hunting rule
Status:
Suspicious
First seen:
2024-01-22 16:41:05 UTC
File Type:
PE (Exe)
Extracted files:
11
AV detection:
2 of 38 (5.26%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=klor3x4slovadils2dscb3eigoqqojxopj647qvfl4paj5d4njrq._file
Verdict:
malicious
Label(s):
cloudeye
Create hunting rule
Result
Malware family:
guloader
Create hunting rule
Score:
  10/10
Tags:
family:azorult family:guloader collection discovery downloader infostealer macos spyware stealer trojan
Link:
https://tria.ge/reports/240122-t6321sbba2/
Behaviour
Checks processor information in registry
Delays execution with timeout.exe
Modifies system certificate store
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: MapViewOfSection
Suspicious use of WriteProcessMemory
outlook_office_path
outlook_win_path
Enumerates physical storage devices
Suspicious use of NtCreateThreadExHideFromDebugger
Suspicious use of NtSetInformationThreadHideFromDebugger
Suspicious use of SetThreadContext
Accesses Microsoft Outlook profiles
Accesses cryptocurrency files/wallets, possible credential harvesting
Checks installed software on the system
Checks computer location settings
Deletes itself
Loads dropped DLL
Reads data files stored by FTP clients
Reads local data of messenger clients
Reads user/profile data of local email clients
Reads user/profile data of web browsers
Azorult
Guloader,Cloudeye
Unpacked files
SH256 hash:
c4c6fe032f3cd8b31528d7b99661f85ee22cb78746aee98ec568431d4f5043f7
MD5 hash:
b55f7f1b17c39018910c23108f929082
SHA1 hash:
1601f1cc0d0d6bcf35799b7cd15550cd01556172
Link:
https://www.unpac.me/results/a1dab77e-d499-48e2-b216-172d84b1e9ab/
SH256 hash:
bd046e6497b304e4ea4ab102cab2b1f94ce09bde0eebba4c59942a732679e4eb
MD5 hash:
17ed1c86bd67e78ade4712be48a7d2bd
SHA1 hash:
1cc9fe86d6d6030b4dae45ecddce5907991c01a0
Link:
https://www.unpac.me/results/a1dab77e-d499-48e2-b216-172d84b1e9ab/
SH256 hash:
c13104552b8b553159f50f6e2ca45114493397a6fa4bf2cbb960c4a2bbd349ab
MD5 hash:
42b064366f780c1f298fa3cb3aeae260
SHA1 hash:
5b0349db73c43f35227b252b9aa6555f5ede9015
Link:
https://www.unpac.me/results/a1dab77e-d499-48e2-b216-172d84b1e9ab/
SH256 hash:
e69ee897084fcdaf301b710386853fe867c9ed036222be44ba7b5a080e828ffb
MD5 hash:
1a6d0cfb6b904c4bf63491728ce9cf06
SHA1 hash:
ad29426b4888c0f23b758d42320e1ad6cd731133
Link:
https://www.unpac.me/results/a1dab77e-d499-48e2-b216-172d84b1e9ab/
SH256 hash:
e148a4f64eb0c1472c03555d07ab9eacda5a6b3c162795c56b960cebcaf05885
MD5 hash:
ac8e1e852a22e5042ca90e6b0fe506f9
SHA1 hash:
465069b312737f4233964297147ba984696c1549
Link:
https://www.unpac.me/results/a1dab77e-d499-48e2-b216-172d84b1e9ab/
SH256 hash:
52dd1ddf925baa01a172d0e420ec8833a10726ee7a7dcfc2a55f1e04f47c6a63
MD5 hash:
5ad5fcac5705acde3ed51ae6b3c2c0b1
SHA1 hash:
77a26b80323ac8e1f172d8ce980120454ed53939
Link:
https://www.unpac.me/results/a1dab77e-d499-48e2-b216-172d84b1e9ab/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Azorult
Score:
0.90
Link:
https://yomi.yoroi.company/submissions/52dd1ddf925baa01a172d0e420ec8833a10726ee7a7dcfc2a55f1e04f47c6a63

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:PE_Digital_Certificate
Create hunting rule
Author:albertzsigovits

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/472334/

Comments