🤲🏼 NEW | abuse.ch Community Hub! Earn recognition 🏅 for the malware intelligence you share, climb the leaderboards 📈, and connect with like-minded contributors who share your hunting focus 🤝. Ready to unlock your profile? Go to the Community Hub →

MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 901bd78dd5f4d5eb078febeca867339697010e69ea5a5ccd2edc101ea1320814. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AZORult


Vendor detections: 8


Intelligence 8 IOCs YARA 2 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 901bd78dd5f4d5eb078febeca867339697010e69ea5a5ccd2edc101ea1320814
SHA3-384 hash: 63dfde5ef03b336f66d77c097d4de32845a7884b0de4b5d98eef90c151ad52ea77b80aa8ba2cd223104d8bcc7d547e2f
SHA1 hash: 2bd34fd6f6bce2e66cd445e6121e42bc45e5f077
MD5 hash: 9c2c1251c5f7a4c8e83f2e4f3c025e10
humanhash: solar-uncle-spaghetti-kitten
File name:virussign.com_9c2c1251c5f7a4c8e83f2e4f3c025e10
Download: download sample
Signature AZORult
Create hunting rule
File size:7'091'200 bytes
First seen:2022-07-15 17:05:35 UTC
Last seen:2024-07-24 18:59:16 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash 4a894b49c435cb911bf76f7e3c256812 (1 x AZORult)
ssdeep 49152:DUAzbm3SV2yGqC2Zq9VvoeGjDkp7Gf+sqX+QpV67JSk2Msjs+DQxCZLoeWgGinHJ:DjjZjDkp7zsqJeJw99ZLo8fg
TLSH T14C667C03A2858437E0631A3A5C77D395583FBA212B2A9DC76FE40E4D0E356C16E3E75B
TrID 51.2% (.CPL) Windows Control Panel Item (generic) (197083/11/60)
28.5% (.EXE) Inno Setup installer (109740/4/30)
10.8% (.EXE) Win32 EXE PECompact compressed (generic) (41569/9/9)
2.7% (.EXE) Win64 Executable (generic) (10523/12/4)
2.6% (.EXE) DOS Borland compiled Executable (generic) (10000/1/2)
File icon (PE):PE icon
dhash icon 2198c6f3edefefc7 (1 x AZORult)
Reporter KdssSupport
Tags:AZORult exe


Avatar
KdssSupport
Uploaded with API

Intelligence

File Origin
# of uploads :
2
# of downloads :
693
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
virussign.com_9c2c1251c5f7a4c8e83f2e4f3c025e10
Verdict:
No threats detected
Analysis date:
2022-07-16 01:44:30 UTC
Tags:
installer
Link:
https://app.any.run/tasks/2ceda6db-0fd3-41ac-a34e-a026cbfae236

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/290293/
Detection(s):
PUA.Win.Packer.Exe-6
Create hunting rule

Win.Malware.Agentb-9881438-0
Create hunting rule

Win.Malware.Agentb-9881523-0
Create hunting rule

Win.Trojan.Agent-1234576
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Сreating synchronization primitives
Creating a window
Creating a file
Searching for synchronization primitives
Changing a file
Sending a custom TCP request
Blocking the User Account Control
Enabling autorun with the standard Software\Microsoft\Windows\CurrentVersion\Run registry branch
Verdict:
Likely Malicious
Threat level:
  7.5/10
Confidence:
100%
Tags:
anti-debug greyware greyware keylogger packed spyeye
Link:
https://www.filescan.io/uploads/62d19eebd6d93426cef2002f/reports/35380fc3-0b9b-4027-a8c7-ef43a11b1c26/overview
Result
Threat name:
Unknown
Detection:
malicious
Classification:
evad
Score:
92 / 100
Link:
https://www.joesandbox.com/analysis/1033352
Signature
Antivirus / Scanner detection for submitted sample
Antivirus detection for dropped file
Changes the view of files in windows explorer (hidden files and folders)
Disable Task List ballon tips (likely to surpress security warnings)
Found API chain indicative of debugger detection
Machine Learning detection for dropped file
Machine Learning detection for sample
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Behaviour
Behavior Graph:
Download SVG
Detection:
azorult
Create hunting rule
Link:
https://mwdb.cert.pl/sample/901bd78dd5f4d5eb078febeca867339697010e69ea5a5ccd2edc101ea1320814/
Threat name:
Win32.Trojan.KryptInject
Create hunting rule
Status:
Malicious
First seen:
2022-07-11 22:52:00 UTC
File Type:
PE (Exe)
Extracted files:
249
AV detection:
26 of 26 (100.00%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=san5pdov6tk6wb4p5pwkqzzts2lqcdtj5jnfztjo3qib5ijsbaka._file
Result
Malware family:
n/a
Score:
  10/10
Tags:
evasion persistence trojan
Link:
https://tria.ge/reports/220715-vmeqradhaj/
Behaviour
System policy modification
Enumerates physical storage devices
Adds Run key to start application
Checks whether UAC is enabled
UAC bypass
Unpacked files
SH256 hash:
901bd78dd5f4d5eb078febeca867339697010e69ea5a5ccd2edc101ea1320814
MD5 hash:
9c2c1251c5f7a4c8e83f2e4f3c025e10
SHA1 hash:
2bd34fd6f6bce2e66cd445e6121e42bc45e5f077
Link:
https://www.unpac.me/results/06f82359-55db-45dc-8ee0-530db61fc687/
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/901bd78dd5f4/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/901bd78dd5f4d5eb078febeca867339697010e69ea5a5ccd2edc101ea1320814

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:meth_get_eip
Create hunting rule
Author:Willi Ballenthin
Rule name:pdb_YARAify
Create hunting rule
Author:@wowabiy314
Description:PDB

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

AZORult

Executable exe 901bd78dd5f4d5eb078febeca867339697010e69ea5a5ccd2edc101ea1320814

(this sample)

  
Delivery method
Distributed via web download
Cape
Cape
https://www.capesandbox.com/analysis/290293/

Comments