MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 79a7c9d15971c14d78baccbf211b3ca1e9adcb0befc6d3d1c5d92902d70678e2. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AZORult


Vendor detections: 13


Intelligence 13 IOCs YARA 7 File information Comments 1
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 79a7c9d15971c14d78baccbf211b3ca1e9adcb0befc6d3d1c5d92902d70678e2
SHA3-384 hash: 770fbcc01f122be3d32590443a5eea8c3fadc4fed8af2cb6516cc7a4d48a50217f18719d0347098dec9812866cd3b5a5
SHA1 hash: 0b7a3073fc4577f9084756e5bac8f1161d175106
MD5 hash: f73c911c5f5191bd04380be95af6c871
humanhash: illinois-black-pip-london
File name:f73c911c5f5191bd04380be95af6c871
Download: download sample
Signature AZORult
Create hunting rule
File size:2'975'232 bytes
First seen:2023-05-11 12:41:08 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'748 x AgentTesla, 19'642 x Formbook, 12'245 x SnakeKeylogger)
ssdeep 49152:BkmDyTgAKWAoP3JBTMF7PYye44vXpjBP:
Threatray 215 similar samples on MalwareBazaar
TLSH T128D523305F467C2FDBBC1A38F09F2F180D611EA7810CA4AF6949998546FF794AB92C74
TrID 63.0% (.EXE) Generic CIL Executable (.NET, Mono, etc.) (73123/4/13)
11.2% (.SCR) Windows screen saver (13097/50/3)
9.0% (.EXE) Win64 Executable (generic) (10523/12/4)
5.6% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
3.8% (.EXE) Win32 Executable (generic) (4505/5/1)
Reporter zbetcheckin
Tags:32 AZORult exe

Intelligence

File Origin
# of uploads :
1
# of downloads :
310
Origin country :
FR FR
Vendor Threat Intelligence
Malware family:
azorult
Create hunting rule
ID:
1
File name:
f73c911c5f5191bd04380be95af6c871
Verdict:
Malicious activity
Analysis date:
2023-05-11 12:43:44 UTC
Tags:
trojan rat azorult loader
Link:
https://app.any.run/tasks/ba1dd41c-b347-4bd6-93d4-9fc0215b45b6

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/388405/
Detection(s):
SecuriteInfo.com.Heur.MSIL.Krypt.11.19530.32490.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Сreating synchronization primitives
Creating a file in the %temp% directory
Creating a process from a recently created file
Creating a file
Using the Windows Management Instrumentation requests
Searching for synchronization primitives
Launching the default Windows debugger (dwwin.exe)
Launching a process
Deleting a recently created file
Unauthorized injection to a recently created process
Unauthorized injection to a recently created process by context flags manipulation
Enabling autorun by creating a file
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
obfuscated packed
Link:
https://www.filescan.io/uploads/645ce29b0516095d50d3d0eb/reports/d63e8c2f-c9f9-49fd-9884-4226334a612b/overview
Verdict:
Malicious
Labled as:
MSIL.Krypt.Generic
Link:
https://www.hybrid-analysis.com/sample/79a7c9d15971c14d78baccbf211b3ca1e9adcb0befc6d3d1c5d92902d70678e2
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Verdict:
Unknown
Link:
https://analyze.intezer.com/analyses/83ef3119-2c3a-4da4-94e6-567c04a7937f
Result
Threat name:
n/a
Detection:
malicious
Classification:
evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1230762
Signature
.NET source code contains potential unpacker
.NET source code contains very large array initializations
Antivirus / Scanner detection for submitted sample
Antivirus detection for dropped file
Hides threads from debuggers
Injects a PE file into a foreign processes
Machine Learning detection for dropped file
Machine Learning detection for sample
Multi AV Scanner detection for domain / URL
Multi AV Scanner detection for submitted file
Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines)
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Yara detected AntiVM3
Yara detected Costura Assembly Loader
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 863744 Sample: EZJyck0Xhn.exe Startdate: 11/05/2023 Architecture: WINDOWS Score: 100 44 nickshort.ug 2->44 46 nazima.ac.ug 2->46 50 Multi AV Scanner detection for domain / URL 2->50 52 Antivirus / Scanner detection for submitted sample 2->52 54 Multi AV Scanner detection for submitted file 2->54 56 6 other signatures 2->56 9 EZJyck0Xhn.exe 5 2->9         started        13 IsClosed.exe 2 2->13         started        signatures3 process4 file5 40 C:\Users\user\...\Rxignoyvluyblaysccxyah.exe, PE32 9->40 dropped 42 C:\Users\user\AppData\...ZJyck0Xhn.exe.log, ASCII 9->42 dropped 58 Injects a PE file into a foreign processes 9->58 15 Rxignoyvluyblaysccxyah.exe 3 9->15         started        18 EZJyck0Xhn.exe 1 9->18         started        21 EZJyck0Xhn.exe 9->21         started        60 Antivirus detection for dropped file 13->60 62 Machine Learning detection for dropped file 13->62 signatures6 process7 dnsIp8 64 Antivirus detection for dropped file 15->64 66 Machine Learning detection for dropped file 15->66 68 Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines) 15->68 70 Injects a PE file into a foreign processes 15->70 23 Rxignoyvluyblaysccxyah.exe 5 15->23         started        48 94.142.138.105, 3551, 49703 IHOR-ASRU Russian Federation 18->48 72 Hides threads from debuggers 18->72 26 certreq.exe 18->26         started        28 WerFault.exe 18->28         started        30 WerFault.exe 18->30         started        32 3 other processes 18->32 signatures9 process10 file11 38 C:\Users\user\AppData\Local\...\IsClosed.exe, PE32 23->38 dropped 34 WerFault.exe 24 9 23->34         started        36 conhost.exe 26->36         started        process12
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/79a7c9d15971c14d78baccbf211b3ca1e9adcb0befc6d3d1c5d92902d70678e2/
Threat name:
ByteCode-MSIL.Packed.Generic
Create hunting rule
Status:
Suspicious
First seen:
2023-05-11 12:42:09 UTC
File Type:
PE (.Net Exe)
Extracted files:
3
AV detection:
15 of 37 (40.54%)
Threat level:
  1/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=pgt4tukzohau26f2zs7scgz4uhu23syl57dnhuof3euqfvygpdra._file
Verdict:
malicious
Similar samples:
5c7ea36ba0644e026b9a8e6fbaaa4e88f8cc4be90f2ebe96ab041645c0b9bb51
AZORult
5d45948167c781bc6167406bf9b8f97f4fea8d976581c6c5130d9ee5a2b11831
AZORult
65a73b946adeca7edc624d85c9af02b3d607e1e65df2580a32fb143b9c40fc7f
AZORult
65bea8ecbc22a05fe6cdd7108d9859e22de0a6796c7597ff299e4baf0dde04ad
AZORult
6a019592f49db789478da1f5a63e673824a8bffacff9f99c5528072fb3b95ba1
AZORult
9cb4357e2a87559617f3adfcdcfe5dba5f02de53d9d7acd8cc5415bbab703e65
AZORult
a7496f64d8f6fedf5d7684e9b073afc39f7f0254ca3a35de6383445a9235329e
AZORult
cfe0ce3795f3c45d3945d05c010f35e08e42036045e41aa3cf63cb1fb32d2ca6
AZORult
f1b80af506aaf5f0f42514a80a0e5a9828b59a567337554983532308ab3a996f
AZORult
+ 205 additional samples on MalwareBazaar
Result
Malware family:
azorult
Create hunting rule
Score:
  10/10
Tags:
family:azorult collection discovery infostealer spyware stealer trojan
Link:
https://tria.ge/reports/230511-pxbtysfb6x/
Behaviour
Checks processor information in registry
Delays execution with timeout.exe
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
outlook_office_path
outlook_win_path
Enumerates physical storage devices
Program crash
Drops file in System32 directory
Suspicious use of NtSetInformationThreadHideFromDebugger
Suspicious use of SetThreadContext
Accesses Microsoft Outlook profiles
Checks installed software on the system
Checks computer location settings
Executes dropped EXE
Loads dropped DLL
Reads user/profile data of web browsers
Azorult
Suspicious use of NtCreateUserProcessOtherParentProcess
Malware Config
C2 Extraction:
http://195.245.112.115/index.php
Unpacked files
SH256 hash:
6b77e2bfff019609c509c3e559c6870dbb7e8d8b9979affb98440e079c99e354
MD5 hash:
958e4d62824c29a594256646c3d6bbf9
SHA1 hash:
e2f2004a3932381c8e70ecde39a129f0f6add9b0
Link:
https://www.unpac.me/results/20eddf84-bc45-4504-9456-26cfc6006c01/
SH256 hash:
5c1dd5d9a38fb0b35d40a4da977b013b960ec3de035db418e919b704625cf749
MD5 hash:
77152328e231366b4371119302dc9dc3
SHA1 hash:
3a0367f593a39fbbc924c50717b42397ba1a5315
Link:
https://www.unpac.me/results/20eddf84-bc45-4504-9456-26cfc6006c01/
SH256 hash:
76b989056dc96e5c07b881ca19d855e6bd51775bae62105124edb46db0a57fb4
MD5 hash:
018141b6870868bb94861ecb929efc8d
SHA1 hash:
346a26c909a724e35262ed8fa651ebd56fb72b54
Link:
https://www.unpac.me/results/20eddf84-bc45-4504-9456-26cfc6006c01/
SH256 hash:
469b4f947f7552c2945a82a6da467b6ef8269ae23f2e3935aa527da7e3e43661
MD5 hash:
5e468e5229b2765c693cd1bc178fc696
SHA1 hash:
326428879cdeb5c8097ac825f14dc90d7a317fca
Link:
https://www.unpac.me/results/20eddf84-bc45-4504-9456-26cfc6006c01/
SH256 hash:
1cbe18567414b0abed75ebcea478e5e81c155a7d3e9bb13490305ae21fd9d2b5
MD5 hash:
eb94b259d6a31909bb582087ff7cf17e
SHA1 hash:
a2873107269e92c44ce1e6161cbea6bebd1a88df
Link:
https://www.unpac.me/results/20eddf84-bc45-4504-9456-26cfc6006c01/
SH256 hash:
6735e8f636e5964fae74247313cc9317afb8e55ceb653d267ffe992a904081c7
MD5 hash:
404f9eae8682c5071d7744e851cd44d7
SHA1 hash:
707a7d7e21afd3709a2190e41281a06f1d35d04f
Link:
https://www.unpac.me/results/20eddf84-bc45-4504-9456-26cfc6006c01/
SH256 hash:
ff8c24bce1eb009f0d5c47a09b96caf02726c285cea0d635082ad4da27e63d1b
MD5 hash:
9d6ec6072ee1814a4a01d1eb3fb67ba1
SHA1 hash:
d0b416de1c900b6bcb35dc182b2e8744f16c3289
Link:
https://www.unpac.me/results/20eddf84-bc45-4504-9456-26cfc6006c01/
SH256 hash:
a866cd74c1575c54bb31e27296a78dce1c8f442230d42d30a68b14b277643108
MD5 hash:
5a07680110521428046b680977688730
SHA1 hash:
9f105184e4977870accae8d34de669417ba280df
Link:
https://www.unpac.me/results/20eddf84-bc45-4504-9456-26cfc6006c01/
SH256 hash:
1e6d78bf0503d104fe4345f82b7468c5752761bb8051154faec828bb6d701822
MD5 hash:
e43e79d40b1b8becff53f25189f221f4
SHA1 hash:
7a100ea2a0c8fba54ed5c8cb588ece2e8b99e0a5
Detections:
win_brute_ratel_c4_w0
Create hunting rule
Link:
https://www.unpac.me/results/20eddf84-bc45-4504-9456-26cfc6006c01/
SH256 hash:
f3e64068f9f9ce67cfa282d700d8194dd8d00c4078519821823f7df3824a3573
MD5 hash:
f0f47dc518bffca0216b9ba732e254a9
SHA1 hash:
0bfd1bb99f6ef3c93ddf5b948033617e293d1ced
Detections:
win_brute_ratel_c4_w0
Create hunting rule
Link:
https://www.unpac.me/results/20eddf84-bc45-4504-9456-26cfc6006c01/
SH256 hash:
79a7c9d15971c14d78baccbf211b3ca1e9adcb0befc6d3d1c5d92902d70678e2
MD5 hash:
f73c911c5f5191bd04380be95af6c871
SHA1 hash:
0b7a3073fc4577f9084756e5bac8f1161d175106
Link:
https://www.unpac.me/results/20eddf84-bc45-4504-9456-26cfc6006c01/
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/79a7c9d15971/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:BitcoinAddress
Create hunting rule
Author:Didier Stevens (@DidierStevens)
Description:Contains a valid Bitcoin address
Rule name:BruteSyscallHashes
Create hunting rule
Author:Embee_Research @ Huntress
Rule name:INDICATOR_EXE_Packed_SmartAssembly
Create hunting rule
Author:ditekSHen
Description:Detects executables packed with SmartAssembly
Rule name:pe_imphash
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash
Rule name:win_brute_ratel_c4_w0
Create hunting rule
Author:Embee_Research @ Huntress

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

AZORult

Executable exe 79a7c9d15971c14d78baccbf211b3ca1e9adcb0befc6d3d1c5d92902d70678e2

(this sample)

  
Delivery method
Distributed via web download
Cape
Cape
https://www.capesandbox.com/analysis/388405/
  
URLhaus
https://urlhaus.abuse.ch/url/2506772/
  
URLhaus
https://urlhaus.abuse.ch/url/2257588/
  
URLhaus
https://urlhaus.abuse.ch/url/2254174/
  
URLhaus
https://urlhaus.abuse.ch/url/2271067/
  
URLhaus
https://urlhaus.abuse.ch/url/2271066/
  
URLhaus
https://urlhaus.abuse.ch/url/2578024/
  
URLhaus
https://urlhaus.abuse.ch/url/2254175/
  
URLhaus
https://urlhaus.abuse.ch/url/2441296/
  
URLhaus
https://urlhaus.abuse.ch/url/2627575/
  
URLhaus
https://urlhaus.abuse.ch/url/265919/
  
URLhaus
https://urlhaus.abuse.ch/url/2627573/
  
URLhaus
https://urlhaus.abuse.ch/url/2577943/
  
URLhaus
https://urlhaus.abuse.ch/url/1514315/
  
URLhaus
https://urlhaus.abuse.ch/url/906880/
  
URLhaus
https://urlhaus.abuse.ch/url/1596393/
  
URLhaus
https://urlhaus.abuse.ch/url/1514297/
  
URLhaus
https://urlhaus.abuse.ch/url/1514313/
  
URLhaus
https://urlhaus.abuse.ch/url/2254177/
  
URLhaus
https://urlhaus.abuse.ch/url/1514098/
  
URLhaus
https://urlhaus.abuse.ch/url/2257580/

Comments


Avatar
zbet commented on 2023-05-11 12:41:13 UTC

url : hxxp://DoNotReply@lastimaners.ug/asdfg.exe