MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 7877200f3f382801e8f65f786bd6d0fb44da6e8c55d52876cdb5a513ecd56829. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AZORult


Vendor detections: 11


Maldoc score: 37


Intelligence 11 IOCs YARA 7 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 7877200f3f382801e8f65f786bd6d0fb44da6e8c55d52876cdb5a513ecd56829
SHA3-384 hash: 7a751c1df3e28cf74e04dc5f06d786bebaada95df083cd1f8278c98f14ab917686e4dfa34ab7e180b4ac723147f3b43a
SHA1 hash: 4285afd68c743a834ec90270cca08ea5db10bfa7
MD5 hash: 804199ef2e1f55277fbd843cb4c86479
humanhash: autumn-pip-ohio-queen
File name:Curriculo Laura Sperandio.xlsm
Download: download sample
Signature AZORult
Create hunting rule
File size:1'308'232 bytes
First seen:2021-02-07 07:20:09 UTC
Last seen:Never
File type:Excel file xlsm
MIME type:application/vnd.openxmlformats-officedocument.spreadsheetml.sheet
ssdeep 24576:dnVthBFkOnDN0lYSRTdYPNjsAsEhaaQ49wh0FyG/PbmmWqWjChZtJkysyMe:dX/WaxghYPNwKq0FyG7m8Ee
TLSH C95533456AC4DA04F68E7CF7852F118B955B1F9C268C2BD279D8A2FEA3743E10AD3311
Reporter abuse_ch
Tags:AZORult xlsm


Avatar
abuse_ch
AZORult C2:
http://josebrazuca-44072.portmap.host:44072/index.php

Office OLE Information

This malware samples appears to be an Office document. The following table provides more information about this document using oletools and oledump.

OLE id
Maldoc score: 37
OLE dump

MalwareBazaar was able to identify 13 sections in this file using oledump:

Section IDSection sizeSection name
A1449 bytesPROJECT
A292 bytesPROJECTwm
A38048 bytesVBA/EstaPastaDeTrabalho
A41676 bytesVBA/Planilha1
A53145 bytesVBA/_VBA_PROJECT
A62695 bytesVBA/__SRP_0
A7226 bytesVBA/__SRP_1
A81906 bytesVBA/__SRP_2
A9346 bytesVBA/__SRP_3
A10376 bytesVBA/__SRP_4
A11120 bytesVBA/__SRP_5
A12555 bytesVBA/dir
OLE vba

MalwareBazaar was able to extract and deobfuscate VBA script(s) the following information from OLE objects embedded in this file using olevba:

TypeKeywordDescription
AutoExecWorkbook_OpenRuns when the Excel Workbook is opened
IOCWindowsDefender.exeExecutable file name
IOCpayloadEmail.exeExecutable file name
IOCWindowsDefenderModulExecutable file name
SuspiciousEnvironmentMay read system environment variables
SuspiciousOpenMay open a file
SuspiciousWriteMay write to a file (if combined with Open)
SuspiciousPutMay write to a file (if combined with Open)
SuspiciousBinaryMay read or write a binary file (if combined with Open)
SuspiciousShellMay run an executable file or a system command
SuspiciousWScript.ShellMay run an executable file or a system command
SuspiciousRunMay run an executable file or a system command
SuspiciousStart-ProcessMay run an executable file or a system command using PowerShell
SuspiciousCreateObjectMay create an OLE object
SuspiciousNew-ObjectMay create an OLE object using PowerShell
SuspiciousNet.WebClientMay download files from the Internet using PowerShell
SuspiciousDownloadFileMay download files from the Internet using PowerShell
SuspiciousXorMay attempt to obfuscate specific strings (use option --deobf to deobfuscate)
SuspiciousSystemMay run an executable file or a system command on a Mac (if combined with libc.dylib)
SuspiciousexecMay run an executable file or a system
SuspiciousHex StringsHex-encoded strings were detected, may be used to obfuscate strings (option --decode to see all)
SuspiciousBase64 StringsBase64-encoded strings were detected, may be used to obfuscate strings (option --decode to see all)

Intelligence

File Origin
# of uploads :
1
# of downloads :
389
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
Curriculo Laura Sperandio.xlsm
Verdict:
Malicious activity
Analysis date:
2021-02-07 07:21:35 UTC
Tags:
macros macros-on-open
Link:
https://app.any.run/tasks/6152762d-98b6-4cfe-bdd0-95bc52c21663

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Verdict:
Malicious
File type:
application/vnd.ms-excel.sheet.macroEnabled.12
Has a screenshot:
False
Contains macros:
True
Detection(s):
SecuriteInfo.com.Generic-EXE.UNOFFICIAL
Create hunting rule

MiscreantPunch.EXEInsideOfDoc.B64.2.UNOFFICIAL
Create hunting rule

SecuriteInfo.com.PUA.Base64EXE-2.UNOFFICIAL
Create hunting rule

Doc.Dropper.Agent-6412232-1
Create hunting rule

MiscreantPunch.EvilMacro.UnkPSDL.170214.UNOFFICIAL
Create hunting rule

Sanesecurity.Badmacro.Doc.newobj.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
Creating a file
Using the Windows Management Instrumentation requests
Creating a file in the %temp% directory
Launching a process
Creating a process with a hidden window
Deleting a recently created file
DNS request
Sending a custom TCP request
Launching the process to change the firewall settings
Launching the process to change network settings
Creating a process from a recently created file
Unauthorized injection to a system process
Result
Verdict:
Malicious
File Type:
Excel File with Macro
Link:
https://app.docguard.net/7877200f3f382801e8f65f786bd6d0fb44da6e8c55d52876cdb5a513ecd56829/results/dashboard
Payload URLs
URL
File name
https://www.linkedin.com/in/laurasperandio4890/_________________
sharedStrings.xml
Result
Verdict:
MALICIOUS
Details
Macro with Startup Hook
Detected macro logic that will automatically execute on document open. Most malware contains some execution hook.
Macro Contains Suspicious String
Detected a macro with a suspicious string. Suspicious strings include privileged function calls, obfuscations, odd registry keys, etc...
InQuest Machine Learning
An InQuest machine-learning model classified this macro as potentially malicious.
Malicious Scriptlet 2 of 7
Detected a malicious pivot typically seen during the 'file-less' pivot commonly seen in malware carriers.
Base64 Encoded Executable in XML
Detected an Office XML file containing a base64 encoded executable.
External Relationship Element
Document contains an externally hosted relationship, which fetches further content.
Result
Threat name:
Unknown
Detection:
malicious
Classification:
expl.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/601199
Signature
Binary contains a suspicious time stamp
Compiles code to access protected / encrypted code
Disables the windows firewall (over ALG)
Document contains an embedded VBA macro which may execute processes
Document contains an embedded VBA macro with suspicious strings
Document contains an embedded VBA with functions possibly related to WSH operations (process, registry, environment, or keystrokes)
Document exploit detected (creates forbidden files)
Document exploit detected (drops PE files)
Document exploit detected (process start blacklist hit)
Drops PE files to the document folder of the user
Injects a PE file into a foreign processes
Machine Learning detection for sample
Modifies the context of a thread in another process (thread injection)
Modifies the windows firewall
Office process drops PE file
Sigma detected: Microsoft Office Product Spawning Windows Shell
Sigma detected: MS Office Product Spawning Exe in User Dir
Sigma detected: Office product drops executable at suspicious location
Sigma detected: Powershell download and execute file
Suspicious powershell command line found
Tries to download and execute files (via powershell)
Uses netsh to modify the Windows network and firewall settings
Uses powercfg.exe to modify the power settings
Uses schtasks.exe or at.exe to add and modify task schedules
Writes to foreign memory regions
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 349618 Sample: Curriculo Laura Sperandio.xlsm Startdate: 07/02/2021 Architecture: WINDOWS Score: 100 87 Sigma detected: Powershell download and execute file 2->87 89 Sigma detected: Office product drops executable at suspicious location 2->89 91 Document exploit detected (drops PE files) 2->91 93 16 other signatures 2->93 9 EXCEL.EXE 58 21 2->9         started        13 iexplore.exe 3 43 2->13         started        process3 dnsIp4 53 C:\Users\user\Documents\WindowsDefender.exe, PE32+ 9->53 dropped 55 C:\Users\...\~$Curriculo Laura Sperandio.xlsm, data 9->55 dropped 95 Document exploit detected (creates forbidden files) 9->95 97 Suspicious powershell command line found 9->97 99 Tries to download and execute files (via powershell) 9->99 101 Document exploit detected (process start blacklist hit) 9->101 16 WindowsDefender.exe 6 9->16         started        20 powershell.exe 12 7 9->20         started        75 204.79.197.200 MICROSOFT-CORP-MSN-AS-BLOCKUS United States 13->75 77 152.199.19.161 EDGECASTUS United States 13->77 23 iexplore.exe 13->23         started        file5 signatures6 process7 dnsIp8 51 C:\Users\user\AppData\Local\...\sxxh3mwu.0.vb, UTF-8 16->51 dropped 79 Writes to foreign memory regions 16->79 81 Modifies the context of a thread in another process (thread injection) 16->81 83 Compiles code to access protected / encrypted code 16->83 85 Injects a PE file into a foreign processes 16->85 25 RegAsm.exe 16->25         started        29 vbc.exe 5 16->29         started        31 RegAsm.exe 16->31         started        33 RegAsm.exe 16->33         started        63 8.8.8.8 GOOGLEUS United States 20->63 65 104.192.141.1 AMAZON-02US United States 20->65 67 13.107.42.14 MICROSOFT-CORP-MSN-AS-BLOCKUS United States 23->67 69 35.241.57.45 GOOGLEUS United States 23->69 71 5 other IPs or domains 23->71 file9 signatures10 process11 dnsIp12 73 52.216.93.27 AMAZON-02US United States 25->73 57 C:\Users\user\AppData\...\Defender.exe, PE32+ 25->57 dropped 59 C:\Users\user\...\IntelManagementConsole.exe, PE32 25->59 dropped 35 powershell.exe 25->35         started        37 powershell.exe 25->37         started        39 IntelManagementConsole.exe 25->39         started        61 C:\Users\user\AppData\Local\...\sxxh3mwu.dll, PE32 29->61 dropped 41 cvtres.exe 29->41         started        file13 process14 process15 43 schtasks.exe 35->43         started        45 powercfg.exe 35->45         started        47 powercfg.exe 35->47         started        49 6 other processes 35->49
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/7877200f3f382801e8f65f786bd6d0fb44da6e8c55d52876cdb5a513ecd56829/
Threat name:
Script-Macro.Trojan.Valyria
Create hunting rule
Status:
Malicious
First seen:
2021-02-07 07:21:06 UTC
AV detection:
15 of 29 (51.72%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=pb3sadz7hauad2hwl54gxvwq7ncnu3umkxksq5wnwwsrh3gvnauq._file
Result
Malware family:
xmrig
Create hunting rule
Score:
  10/10
Tags:
family:azorult family:xmrig evasion infostealer miner trojan
Link:
https://tria.ge/reports/210207-4hb55yjq1n/
Behaviour
Creates scheduled task(s)
Enumerates system info in registry
Modifies Internet Explorer settings
Suspicious behavior: AddClipboardFormatListener
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
Office loads VBA resources, possible macro or embedded object present
Drops file in Windows directory
Drops file in System32 directory
Suspicious use of SetThreadContext
Legitimate hosting services abused for malware hosting/C2
Loads dropped DLL
Uses the VBS compiler for execution
Executes dropped EXE
Modifies Windows Firewall
XMRig Miner Payload
Azorult
Contains code to disable Windows Defender
Modifies Windows Defender Real-time Protection settings
xmrig
Malware Config
C2 Extraction:
http://josebrazuca-44072.portmap.host:44072/index.php
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/7877200f3f382801e8f65f786bd6d0fb44da6e8c55d52876cdb5a513ecd56829

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:Email_stealer_bin_mem
Create hunting rule
Author:James_inthe_box
Description:Email in files like avemaria
Rule name:INDICATOR_SUSPICIOUS_DisableWinDefender
Create hunting rule
Author:ditekSHen
Description:Detects executables containing artifcats associated with disabling Widnows Defender
Rule name:INDICATOR_SUSPICIOUS_Stomped_PECompilation_Timestamp_InTheFu
Create hunting rule
Author:ditekSHen
Description:Detect executables with stomped PE compilation timestamp that is greater than local current time
Rule name:IPPort_combo_mem
Create hunting rule
Author:James_inthe_box
Description:IP and port combo
Rule name:Select_from_enumeration
Create hunting rule
Author:James_inthe_box
Description:IP and port combo
Rule name:SharedStrings
Create hunting rule
Author:Katie Kleemola
Description:Internal names found in LURK0/CCTV0 samples
Rule name:UAC_bypass_bin_mem
Create hunting rule
Author:James_inthe_box
Description:UAC bypass in files like avemaria

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AZORult

Excel file xlsm 7877200f3f382801e8f65f786bd6d0fb44da6e8c55d52876cdb5a513ecd56829

(this sample)

  
Delivery method
Distributed via e-mail attachment

Comments