MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 93ddf61c1aa7c0b867ffbd579b9febdeed4b027d14f8b86d62f7da493706731c. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AZORult


Vendor detections: 13


Intelligence 13 IOCs 1 YARA 7 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 93ddf61c1aa7c0b867ffbd579b9febdeed4b027d14f8b86d62f7da493706731c
SHA3-384 hash: 3a1f700f7c9ee39f5605ae52c829d9173f706fe4effc442f1f96d8c8ed5d24af77631283ca866560984831f439b269b8
SHA1 hash: fa6b1d998500175e122de2c264869fda667bcd26
MD5 hash: b23d6c569893579789695f3d05accbe1
humanhash: idaho-fifteen-timing-hamper
File name:b23d6c569893579789695f3d05accbe1.exe
Download: download sample
Signature AZORult
Create hunting rule
File size:1'462'784 bytes
First seen:2021-09-02 15:26:15 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'652 x AgentTesla, 19'463 x Formbook, 12'204 x SnakeKeylogger)
ssdeep 24576:ckJ57Lut19vrBg9qm+BZkvgt7DYOl+FbSoLCwcpN5tgLG6OI8mMe2WLPFouz:T7LG1V/dBZkY1Yo+X+tgLGPi2WLPFou
Threatray 3'457 similar samples on MalwareBazaar
TLSH T1E76523A07F21CC90D6949C7CBC9790E5E362E84C4A75FB84D1CB678A278732ADE31527
dhash icon d4ccace968ecccca (1 x RedLineStealer, 1 x AZORult, 1 x RaccoonStealer)
Reporter abuse_ch
Tags:AZORult exe


Avatar
abuse_ch
AZORult C2:
http://5.181.156.221/

Indicators Of Compromise (IOCs)

Below is a list of indicators of compromise (IOCs) associated with this malware samples.

IOCThreatFox Reference
http://5.181.156.221/ https://threatfox.abuse.ch/ioc/213378/

Intelligence

File Origin
# of uploads :
1
# of downloads :
1'025
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
b23d6c569893579789695f3d05accbe1.exe
Verdict:
Malicious activity
Analysis date:
2021-09-02 15:28:37 UTC
Tags:
trojan stealer raccoon loader rat azorult vidar
Link:
https://app.any.run/tasks/b716fa59-c9ad-4b77-afc0-927387eb5a19

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/184836/
Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
Launching a process
Creating a process with a hidden window
Sending a UDP request
Forced system process termination
Creating a file in the %temp% directory
Creating a process from a recently created file
Creating a file
Connection attempt to an infection source
Connection attempt
Sending an HTTP POST request
Sending an HTTP GET request
Deleting a recently created file
Reading critical registry keys
Delayed reading of the file
Running batch commands
Unauthorized injection to a recently created process
Unauthorized injection to a recently created process by context flags manipulation
Query of malicious DNS domain
Sending a TCP request to an infection source
Stealing user critical data
Malware family:
Raccoon Stealer
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/89b1b339-9976-4692-b63d-cfaf3abaa098
Result
Threat name:
Azorult Raccoon
Create hunting rule
Detection:
malicious
Classification:
phis.troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/844151
Signature
.NET source code contains potential unpacker
Found many strings related to Crypto-Wallets (likely being stolen)
Injects a PE file into a foreign processes
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for submitted file
Self deletion via cmd delete
Sigma detected: Suspicious Script Execution From Temp Folder
Sigma detected: WScript or CScript Dropper
Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)
Tries to harvest and steal Bitcoin Wallet information
Tries to harvest and steal browser information (history, passwords, etc)
Tries to harvest and steal ftp login credentials
Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)
Tries to steal Crypto Currency Wallets
Tries to steal Instant Messenger accounts or passwords
Tries to steal Mail credentials (via file access)
Uses powershell Test-Connection to delay payload execution;
Writes to foreign memory regions
Yara detected Azorult
Yara detected Azorult Info Stealer
Yara detected Raccoon Stealer
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 476590 Sample: EIRWWrdl3w.exe Startdate: 02/09/2021 Architecture: WINDOWS Score: 100 92 mazooyaar.ac.ug 2->92 100 Snort IDS alert for network traffic (e.g. based on Emerging Threat rules) 2->100 102 Malicious sample detected (through community Yara rule) 2->102 104 Multi AV Scanner detection for submitted file 2->104 106 9 other signatures 2->106 10 EIRWWrdl3w.exe 3 8 2->10         started        signatures3 process4 file5 80 C:\Users\...\Oggnfkemtibcinconsoleapp16.exe, PE32 10->80 dropped 82 C:\Users\user\AppData\...IRWWrdl3w.exe, PE32 10->82 dropped 84 C:\Users\...IRWWrdl3w.exe:Zone.Identifier, ASCII 10->84 dropped 86 2 other malicious files 10->86 dropped 120 Writes to foreign memory regions 10->120 122 Uses powershell Test-Connection to delay payload execution; 10->122 124 Injects a PE file into a foreign processes 10->124 14 wscript.exe 10->14         started        16 EIRWWrdl3w.exe 10->16         started        21 powershell.exe 8 10->21         started        23 9 other processes 10->23 signatures6 process7 dnsIp8 25 Oggnfkemtibcinconsoleapp16.exe 14->25         started        88 5.181.156.221, 49710, 49720, 80 MIVOCLOUDMD Moldova Republic of 16->88 90 telete.in 195.201.225.248, 443, 49706 HETZNER-ASDE Germany 16->90 62 C:\Users\user\AppData\LocalLow\sqlite3.dll, PE32 16->62 dropped 64 C:\Users\user\AppData\...\vcruntime140.dll, PE32 16->64 dropped 66 C:\Users\user\AppData\...\ucrtbase.dll, PE32 16->66 dropped 68 56 other files (none is malicious) 16->68 dropped 96 Tries to steal Mail credentials (via file access) 16->96 98 Self deletion via cmd delete 16->98 29 conhost.exe 21->29         started        31 conhost.exe 23->31         started        33 conhost.exe 23->33         started        35 conhost.exe 23->35         started        37 6 other processes 23->37 file9 signatures10 process11 file12 78 C:\...\Hsbvhggsqlrfmuvyptooonsoleapp5.exe, PE32 25->78 dropped 116 Uses powershell Test-Connection to delay payload execution; 25->116 118 Injects a PE file into a foreign processes 25->118 39 Oggnfkemtibcinconsoleapp16.exe 25->39         started        44 powershell.exe 25->44         started        46 powershell.exe 25->46         started        48 9 other processes 25->48 signatures13 process14 dnsIp15 94 mazoyer.ac.ug 185.215.113.77, 49716, 49719, 49721 WHOLESALECONNECTIONSNL Portugal 39->94 70 C:\Users\user\AppData\...\vcruntime140.dll, PE32 39->70 dropped 72 C:\Users\user\AppData\Local\...\ucrtbase.dll, PE32 39->72 dropped 74 C:\Users\user\AppData\Local\...\softokn3.dll, PE32 39->74 dropped 76 45 other files (none is malicious) 39->76 dropped 108 Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc) 39->108 110 Tries to steal Instant Messenger accounts or passwords 39->110 112 Tries to steal Mail credentials (via file access) 39->112 114 4 other signatures 39->114 50 conhost.exe 44->50         started        52 conhost.exe 46->52         started        54 conhost.exe 48->54         started        56 conhost.exe 48->56         started        58 conhost.exe 48->58         started        60 5 other processes 48->60 file16 signatures17 process18
Detection:
raccoon
Create hunting rule
Link:
https://mwdb.cert.pl/sample/93ddf61c1aa7c0b867ffbd579b9febdeed4b027d14f8b86d62f7da493706731c/
Threat name:
ByteCode-MSIL.Trojan.Chapak
Create hunting rule
Status:
Malicious
First seen:
2021-09-02 15:27:12 UTC
AV detection:
10 of 27 (37.04%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=spo7mha2u7alqz77xvlzxh7l33wuwat5ct4lq3lc67nesnygomoa._file
Verdict:
malicious
Label(s):
azorult
Create hunting rule
Similar samples:
14a0d25b4d33216e9110c9588fa3168105efdad28827e772c4798337544eb708
AZORult
547bf6d6ed5ae181513ed653109514c73e5f50c3ea3a094bcd382fbd3c4b4bb0
AZORult
5e08ef6445c40ba0c1216c04291b0d9ef48f0983a9aebd25f214e6fc988daa53
AZORult
7045ebc8901b28437b116f9ff37d6e16caf2b47e3b7986cc233add8410f1ec9f
AZORult
895100760e67763505b9cad311be16b533db48d1f2cb28424a98495406220a2f
AZORult
b7f7c6607354a0b83caccf57efef2d2447d212b7e0ee0f476abf069274cfd90c
AZORult
d0b7a458e09fd14ae8476200bd5acf2fc93ea0e2fea357079a88df80e720c23d
AZORult
e8e31ad00eb7d6e4124e0d9dcd2a2e4ca20afa68007c0e655ae8cc5ca4bfdad9
AZORult
fa40dc2c8055f953099d7d354ba97fbf3a5f3aa501ce95cb8cefa810b80ea5d4
AZORult
+ 3'447 additional samples on MalwareBazaar
Result
Malware family:
raccoon
Create hunting rule
Score:
  10/10
Tags:
family:azorult family:oski family:raccoon botnet:43aae292cfe6f58a13bd7111bdd7d5ded5b23ec3 discovery infostealer spyware stealer trojan
Link:
https://tria.ge/reports/210902-svrdeaaeh7/
Behaviour
Checks processor information in registry
Delays execution with timeout.exe
Kills process with taskkill
Modifies registry class
Modifies system certificate store
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Suspicious use of SetThreadContext
Accesses cryptocurrency files/wallets, possible credential harvesting
Checks installed software on the system
Deletes itself
Loads dropped DLL
Reads user/profile data of local email clients
Reads user/profile data of web browsers
Downloads MZ/PE file
Executes dropped EXE
Azorult
Oski
Raccoon
Malware Config
C2 Extraction:
http://195.245.112.115/index.php
mazooyaar.ac.ug
Unpacked files
SH256 hash:
655d80f9e86d380eb8e1d6d3b994f456a5f908620ed8bd6b9efc04d4e2a64775
MD5 hash:
358f4be3ef2bdee4e9e60dd7ec1cd4be
SHA1 hash:
977ccd33a1dd6d88f89cf8b29a0eb7b4720c25be
Link:
https://www.unpac.me/results/90e072fc-f4d6-4867-acaf-2d54464c8ade/
SH256 hash:
7eaecd463bb52a94af4bb18496d19b1f7dcec4a909677963fd61dcfe860b6b5d
MD5 hash:
2904b6e56d7dac111737c9ee9541c5ee
SHA1 hash:
74e1c50dbef123551d50ac28d53fbccbd3d709ca
Link:
https://www.unpac.me/results/90e072fc-f4d6-4867-acaf-2d54464c8ade/
SH256 hash:
392c3d0f29bb5f0f75b8931f4411a22958776ae277602d7430bb943f367c1aef
MD5 hash:
14aed55b053d7fa0932607ee6b43eab9
SHA1 hash:
698a55881b6ae2419ce25585911bf313e745e1c2
Link:
https://www.unpac.me/results/90e072fc-f4d6-4867-acaf-2d54464c8ade/
SH256 hash:
e62783f703c07f2f029466f481776503657c47a3459dab626187a470db4f9237
MD5 hash:
e46ee59234adc695a2ea384233d8e56e
SHA1 hash:
2d654169a0b2d3f62a6909500db87bf55b3dc124
Detections:
win_raccoon_auto
Create hunting rule
Link:
https://www.unpac.me/results/90e072fc-f4d6-4867-acaf-2d54464c8ade/
Parent samples :
b594ae37dfb90a402bda0803680b455ababcc67e1add26f3c3f8f192d97dbe2a
93ddf61c1aa7c0b867ffbd579b9febdeed4b027d14f8b86d62f7da493706731c
SH256 hash:
3ba311c7315dcaf54dcf06f7c03e09a2d3ea6bf5aa1d561fa96ecccb54e87b01
MD5 hash:
e0de95a8a60db7f5b08c34580f2dcfaf
SHA1 hash:
e40a82eb22c38cc12d013f95d359dda68b5149b7
Detections:
win_azorult_g1
Create hunting rule
win_azorult_auto
Create hunting rule
Link:
https://www.unpac.me/results/90e072fc-f4d6-4867-acaf-2d54464c8ade/
Parent samples :
93ddf61c1aa7c0b867ffbd579b9febdeed4b027d14f8b86d62f7da493706731c
7b8ffb495d71939d9dfb9b4f4b0bd9bd9d3fad675aa487e2b20129c33f877c50
SH256 hash:
a499c44e22eb0d30158939a75a77947d19661e5a7f6fb6d666d9536a7f839f9e
MD5 hash:
2ff51f85f978253305a8cfb57d9b939d
SHA1 hash:
daf6fd769bdebda68b9c22db3a5ce9ec472b3e8d
Link:
https://www.unpac.me/results/90e072fc-f4d6-4867-acaf-2d54464c8ade/
SH256 hash:
291fab5c21b936b0270909398583e828a48094591abc5418ed49e52763732d00
MD5 hash:
c33c5fdbee50f7d962fa065ca4a3c03c
SHA1 hash:
b65b1da693c9dcb25255612f127e33b94c1c52c4
Link:
https://www.unpac.me/results/90e072fc-f4d6-4867-acaf-2d54464c8ade/
SH256 hash:
49be766f5ab87274ffea0588c60708e3a8818150d0b96aabb488a7c66271c3c8
MD5 hash:
92cf6e26ac82a8c35101714178d5c2ac
SHA1 hash:
84af5fee697223951f41fdf1690112f49f6657f2
Link:
https://www.unpac.me/results/90e072fc-f4d6-4867-acaf-2d54464c8ade/
SH256 hash:
93ddf61c1aa7c0b867ffbd579b9febdeed4b027d14f8b86d62f7da493706731c
MD5 hash:
b23d6c569893579789695f3d05accbe1
SHA1 hash:
fa6b1d998500175e122de2c264869fda667bcd26
Link:
https://www.unpac.me/results/90e072fc-f4d6-4867-acaf-2d54464c8ade/
Malware family:
Raccoon v1.7.2
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/93ddf61c1aa7/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/93ddf61c1aa7c0b867ffbd579b9febdeed4b027d14f8b86d62f7da493706731c

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:Azorult
Create hunting rule
Author:JPCERT/CC Incident Response Group
Description:detect Azorult in memory
Reference:internal research
Rule name:INDICATOR_SUSPICIOUS_EXE_Referenfces_Messaging_Clients
Create hunting rule
Author:ditekSHen
Description:Detects executables referencing many email and collaboration clients. Observed in information stealers
Rule name:pe_imphash
Create hunting rule
Rule name:pe_imphash
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash
Rule name:win_azorult_auto
Create hunting rule
Author:Felix Bilstein - yara-signator at cocacoding dot com
Description:Detects win.azorult.
Rule name:win_raccoon_auto
Create hunting rule
Author:Felix Bilstein - yara-signator at cocacoding dot com
Description:Detects win.raccoon.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

AZORult

Executable exe 93ddf61c1aa7c0b867ffbd579b9febdeed4b027d14f8b86d62f7da493706731c

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/1322752/
  
Delivery method
Distributed via web download
Cape
Cape
https://www.capesandbox.com/analysis/184836/
  
URLhaus
https://urlhaus.abuse.ch/url/399076/
  
URLhaus
https://urlhaus.abuse.ch/url/1539152/
  
URLhaus
https://urlhaus.abuse.ch/url/906880/
  
URLhaus
https://urlhaus.abuse.ch/url/1514098/
  
URLhaus
https://urlhaus.abuse.ch/url/1514313/
  
URLhaus
https://urlhaus.abuse.ch/url/422736/

Comments