🤲🏼 NEW | abuse.ch Community Hub! Earn recognition 🏅 for the malware intelligence you share, climb the leaderboards 📈, and connect with like-minded contributors who share your hunting focus 🤝. Ready to unlock your profile? Go to the Community Hub →

MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 64cce06138c3d1dd56f788853e60bb299f673977d1a538fcda92dd68fe5dc905. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AZORult


Vendor detections: 15


Intelligence 15 IOCs 1 YARA 3 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 64cce06138c3d1dd56f788853e60bb299f673977d1a538fcda92dd68fe5dc905
SHA3-384 hash: d4d1843c88495f39753e0c7ab4e2e8e3be1810e691864c3802b7a61bda5fcb9d421af0d8a35343173318ce73e491506e
SHA1 hash: 78297771c1b95df22ddefe5c0a2be3a4068a2667
MD5 hash: 7a228e7f75f1ebf1f07497b4fbbc4048
humanhash: thirteen-hydrogen-apart-montana
File name:64CCE06138C3D1DD56F788853E60BB299F673977D1A53.exe
Download: download sample
Signature AZORult
Create hunting rule
File size:115'200 bytes
First seen:2022-01-26 17:16:19 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash 6d1f2b41411eacafcf447fc002d8cb00 (141 x AZORult)
ssdeep 3072:tuOSXpMx7ZAlHsbfUkolNGti7lfqeSxM3SpyEY3E/Wxg/:Zzx7ZApszolIo7lf/ipT/W
Threatray 1'130 similar samples on MalwareBazaar
TLSH T1FFB3197AF6C19272E02808BDCD46D1B6912D76302D3918B6B2DA4F8CD5F95C26E2C3C7
Reporter abuse_ch
Tags:AZORult exe


Avatar
abuse_ch
AZORult C2:
http://sw1.kl.com.ua/index.php

Indicators Of Compromise (IOCs)

Below is a list of indicators of compromise (IOCs) associated with this malware samples.

IOCThreatFox Reference
http://sw1.kl.com.ua/index.php https://threatfox.abuse.ch/ioc/342133/

Intelligence

File Origin
# of uploads :
1
# of downloads :
559
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
bin.exe
Verdict:
Malicious activity
Analysis date:
2018-11-20 11:38:00 UTC
Tags:
trojan rat azorult
Link:
https://app.any.run/tasks/3dbb1145-34ad-46ae-b21a-3c00b92db92a

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
Azorult
Create hunting rule
Link:
https://www.capesandbox.com/analysis/223559/
Detection(s):
Win.Malware.Delf-6957976-0
Create hunting rule

Win.Ransomware.Delf-6651871-0
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
Launching a process
Сreating synchronization primitives
DNS request
Query of malicious DNS domain
Sending an HTTP POST request to an infection source
Result
Malware family:
n/a
Score:
  5/10
Tags:
n/a
Link:
https://dragonfly.certego.net/analysis/5256/overview
Behaviour
MalwareBazaar
CheckCmdLine
CallCrc32
Verdict:
Suspicious
Threat level:
  5/10
Confidence:
100%
Tags:
fingerprint greyware shell32.dll
Link:
https://www.filescan.io/uploads/61f18217d73ca9d4648e710e/reports/cef07b89-ff3e-4956-9cf4-5e034f2926f4/overview
Malware family:
AZORult
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/00e4df7e-138e-461c-b049-86fb80b29a8b
Result
Threat name:
AZORult
Create hunting rule
Detection:
malicious
Classification:
troj.spyw
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/928142
Behaviour
Behavior Graph:
n/a
Detection:
azorult
Create hunting rule
Link:
https://mwdb.cert.pl/sample/64cce06138c3d1dd56f788853e60bb299f673977d1a538fcda92dd68fe5dc905/
Threat name:
Win32.Infostealer.CoinStealer
Create hunting rule
Status:
Malicious
First seen:
2018-11-15 20:15:23 UTC
File Type:
PE (Exe)
AV detection:
41 of 43 (95.35%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=mtgoayjyypi52vxxrcct4yf3fgpwoolx2gstr7g2slowr7s5zecq._file
Verdict:
malicious
Label(s):
azorult
Create hunting rule
Similar samples:
02d6463c8d80183f843d874ab427c11fc47b6b9ce472608be7be2498c0950ada
AZORult
8185bb58f4a49dc3a96da380986f7d387b8b223605c898f458d6d9b66355b9ee
AZORult
a61be0c4cdd2c7e309cc75f19f38735d01b0e03bc1fd704d9bcf023237985947
AZORult
b9d278c9b5f6bf23521cca17dd20bd372fb7892117b3255f4c4f811aba2ba9c5
AZORult
cba28f8f5fdb89f8574a3da19c0ee289b1f7b4e8fe238743921e7ce2110854dc
AZORult
+ 1'120 additional samples on MalwareBazaar
Result
Malware family:
azorult
Create hunting rule
Score:
  10/10
Tags:
family:azorult infostealer suricata trojan
Link:
https://tria.ge/reports/220126-vtn8rsffer/
Behaviour
Azorult
suricata: ET MALWARE AZORult Variant.4 Checkin M2
suricata: ET MALWARE Win32/AZORult V3.2 Client Checkin M18
suricata: ET MALWARE Win32/AZORult V3.2 Client Checkin M6
Malware Config
C2 Extraction:
http://sw1.kl.com.ua/index.php
Unpacked files
SH256 hash:
64cce06138c3d1dd56f788853e60bb299f673977d1a538fcda92dd68fe5dc905
MD5 hash:
7a228e7f75f1ebf1f07497b4fbbc4048
SHA1 hash:
78297771c1b95df22ddefe5c0a2be3a4068a2667
Detections:
win_azorult_auto
Create hunting rule
win_azorult_g1
Create hunting rule
Link:
https://www.unpac.me/results/2213a3d1-7969-4111-b0cb-c4908d469a9e/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
SNC
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/64cce06138c3d1dd56f788853e60bb299f673977d1a538fcda92dd68fe5dc905

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:Azorult
Create hunting rule
Author:kevoreilly
Description:Azorult Payload
Rule name:INDICATOR_SUSPICIOUS_EXE_References_CryptoWallets
Create hunting rule
Author:ditekSHen
Description:Detects executables referencing many cryptocurrency mining wallets or apps. Observed in information stealers
Rule name:win_azorult_auto
Create hunting rule
Author:Felix Bilstein - yara-signator at cocacoding dot com
Description:Detects win.azorult.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/223559/

Comments