MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 8cadd98cf4cf0379cbe0131b22aeddb68502eeb292a7a0e21718327abee8509c. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

AZORult

Vendor detections: 5

Intelligence 5 IOCs YARA 2 File information Comments 1

SHA256 hash:	8cadd98cf4cf0379cbe0131b22aeddb68502eeb292a7a0e21718327abee8509c
SHA3-384 hash:	c04d6146ff3cef2696d86f14d58892f9e34a99122ff5126d584c29645fa4098b8277bf540646a980d5bbc0a2c902e984
SHA1 hash:	90cb730e3a60d7e57e9331867bfee4c70118e4b0
MD5 hash:	6cdbe5f7395db2c7f7b8996466d1041f
humanhash:	double-shade-paris-texas
File name:	8cadd98cf4cf0379cbe0131b22aeddb68502eeb292a7a0e21718327abee8509c.msi
Download:	download sample
Signature	AZORult Create hunting rule
File size:	6'002'176 bytes
First seen:	2022-06-01 04:23:40 UTC
Last seen:	Never
File type:	msi
MIME type:	application/x-msi
ssdeep	98304:1OYg8ZLblcqPGki2c8YHfGSXK5290ihA:1moZPs2PYH3Kg
TLSH	T128567C93B2C4653EC46B1A364937A664983FBE2129168C1657F43C4CCF356423B3AE7B
TrID	80.0% (.MSI) Microsoft Windows Installer (454500/1/170) 10.7% (.MST) Windows SDK Setup Transform script (61000/1/5) 7.8% (.MSP) Windows Installer Patch (44509/10/5) 1.4% (.) Generic OLE2 / Multistream Compound (8000/1)
Reporter	StopMalvertisin
Tags:	banker brazil Javali msi ousaban

StopMalvertisin

MSI sample from VT
Javali or Grandoreiro (to be tested)

Intelligence

File Origin

# of uploads :

# of downloads :

250

Origin country :

n/a

Vendor Threat Intelligence

Detection:

n/a

Link:

https://www.capesandbox.com/analysis/275863/

Detection(s):

PUA.Win.Packer.Exe-6

SecuriteInfo.com.Trojan.AgentSpy.68.19276.18114.UNOFFICIAL

Result

Verdict:

MALICIOUS

Link:

https://labs.inquest.net/dfi/sha256/8cadd98cf4cf0379cbe0131b22aeddb68502eeb292a7a0e21718327abee8509c

Result

Threat name:

Unknown

Detection:

malicious

Classification:

n/a

Score:

80 / 100

Link:

https://www.joesandbox.com/analysis/1004704

Signature

Antivirus detection for dropped file

Antivirus detection for URL or domain

Multi AV Scanner detection for domain / URL

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Behaviour

Behavior Graph:

Download SVG

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/8cadd98cf4cf0379cbe0131b22aeddb68502eeb292a7a0e21718327abee8509c/

Threat name:

Win32.Trojan.Grandoreiro

Status:

Malicious

First seen:

2022-05-31 10:23:38 UTC

File Type:

Binary (Archive)

Extracted files:

196

AV detection:

21 of 26 (80.77%)

Threat level:

5/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=rsw5tdhuz4bxts7acmnsflw5w2cqf3vsskt2byqxdazhvpxikcoa._file

Result

Malware family:

n/a

Score:

7/10

Tags:

n/a

Link:

https://tria.ge/reports/220601-e1c63shher/

Behaviour

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Suspicious use of FindShellTrayWindow

Suspicious use of WriteProcessMemory

Drops file in Windows directory

Enumerates connected drives

Loads dropped DLL

Verdict:

Malicious

Link:

https://www.vmray.com/analyses/_mb/8cadd98cf4cf/report/overview.html

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Suspicious File

Score:

0.45

Link:

https://yomi.yoroi.company/submissions/8cadd98cf4cf0379cbe0131b22aeddb68502eeb292a7a0e21718327abee8509c

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	suspicious_msi_file Create hunting rule
Author:	Johnk3r
Description:	Detects common strings, DLL and API in Banker_BR

Rule name:	win_houdini_auto Create hunting rule
Author:	Felix Bilstein - yara-signator at cocacoding dot com
Description:	autogenerated rule brought to you by yara-signator