🤲🏼 NEW | abuse.ch Community Hub! Earn recognition 🏅 for the malware intelligence you share, climb the leaderboards 📈, and connect with like-minded contributors who share your hunting focus 🤝. Ready to unlock your profile? Go to the Community Hub →

MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 94d77da6e9ba6786e66b3864a9092a028d4e076774a5003b50eea0b5b04be074. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AZORult


Vendor detections: 12


Intelligence 12 IOCs 1 YARA 5 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 94d77da6e9ba6786e66b3864a9092a028d4e076774a5003b50eea0b5b04be074
SHA3-384 hash: 643dcaa92c0b5449f6804de7a0f48f95aef21948bf26b403b8bcf8b15a019c481230400c84c632be565b712d931d2df0
SHA1 hash: 03313a12f94a0923bd456a058bb974e43f3c8562
MD5 hash: 6b67c037861d71932f9971faade3c695
humanhash: colorado-happy-floor-shade
File name:SC-91048-docs.exe
Download: download sample
Signature AZORult
Create hunting rule
File size:608'241 bytes
First seen:2024-07-17 12:20:21 UTC
Last seen:2024-07-24 19:13:08 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash 671f2a1f8aee14d336bab98fea93d734 (204 x GuLoader, 4 x Formbook, 4 x RemcosRAT)
ssdeep 12288:sCn4AyHnr1nomoZlKOKIQxRGul47sbYY6UsGVPCHNwEX:/nEnrVvfOdQxJ47skYxsGVcNb
TLSH T11CD4128BBB8185F1CA7C9970D5F786440F7ABDFA9D85061B124E331D7CB2EDE811980A
TrID 47.3% (.EXE) Win32 Executable MS Visual C++ (generic) (31206/45/13)
15.9% (.EXE) Win64 Executable (generic) (10523/12/4)
9.9% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
7.6% (.EXE) Win16 NE executable (generic) (5038/12/1)
6.8% (.EXE) Win32 Executable (generic) (4504/4/1)
File icon (PE):PE icon
dhash icon c8c0e0b296caf200 (15 x GuLoader, 1 x AZORult, 1 x RemcosRAT)
Reporter abuse_ch
Tags:AZORult exe


Avatar
abuse_ch
AZORult C2:
http://ccrhs.shop/LB341/index.php

Indicators Of Compromise (IOCs)

Below is a list of indicators of compromise (IOCs) associated with this malware samples.

IOCThreatFox Reference
http://ccrhs.shop/LB341/index.php https://threatfox.abuse.ch/ioc/1301932/

Intelligence

File Origin
# of uploads :
3
# of downloads :
415
Origin country :
NL NL
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Win32.Evo-gen.17743.20736.UNOFFICIAL
Create hunting rule

Verdict:
Malicious
Score:
70%
Link:
https://cyber-fortress.com/docs/result/index.php?id=6697b7304de77648397b79d0
Tags:
Encryption Execution Generic
Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
Creating a file in the %AppData% subdirectories
Creating a file in the %temp% subdirectories
Searching for the window
Searching for the Windows task manager window
Creating a file in the Program Files subdirectories
Creating a file in the Windows subdirectories
Launching a process
Using the Windows Management Instrumentation requests
Creating a file
Verdict:
Likely Malicious
Threat level:
  7.5/10
Confidence:
100%
Tags:
installer lolbin microsoft_visual_cc overlay packed shell32
Link:
https://www.filescan.io/uploads/6697b7387b9add553ed631d0/reports/070a636e-daaf-4c26-b4c7-bfdf1ebe0260/overview
Verdict:
Malicious
Labled as:
Malware
Link:
https://www.hybrid-analysis.com/sample/94d77da6e9ba6786e66b3864a9092a028d4e076774a5003b50eea0b5b04be074
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/ce0bda11-89ca-46e9-9b22-0ef0e3cce856
Result
Threat name:
Azorult, GuLoader
Create hunting rule
Detection:
malicious
Classification:
phis.troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1474982
Signature
AI detected suspicious sample
Antivirus detection for URL or domain
Found many strings related to Crypto-Wallets (likely being stolen)
Found suspicious powershell code related to unpacking or dynamic code loading
Malicious sample detected (through community Yara rule)
Powershell drops PE file
Snort IDS alert for network traffic
Suspicious powershell command line found
Switches to a custom stack to bypass stack traces
Tries to harvest and steal Bitcoin Wallet information
Tries to harvest and steal browser information (history, passwords, etc)
Tries to harvest and steal ftp login credentials
Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)
Tries to steal Crypto Currency Wallets
Tries to steal Instant Messenger accounts or passwords
Tries to steal Mail credentials (via file / registry access)
Writes to foreign memory regions
Yara detected Azorult
Yara detected GuLoader
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1474982 Sample: SC-91048-docs.exe Startdate: 17/07/2024 Architecture: WINDOWS Score: 100 51 ccrhs.shop 2->51 53 novovisualcabeleireiros.com.br 2->53 59 Snort IDS alert for network traffic 2->59 61 Malicious sample detected (through community Yara rule) 2->61 63 Antivirus detection for URL or domain 2->63 65 3 other signatures 2->65 10 SC-91048-docs.exe 3 35 2->10         started        signatures3 process4 file5 39 C:\Users\user\AppData\...\Cytoplasmiske.Inl, ASCII 10->39 dropped 41 C:\Users\user\AppData\Local\...\nsExec.dll, PE32 10->41 dropped 43 C:\Users\user\AppData\Local\...\nsDialogs.dll, PE32 10->43 dropped 45 C:\Users\user\AppData\Local\...\BgImage.dll, PE32 10->45 dropped 75 Suspicious powershell command line found 10->75 14 powershell.exe 20 10->14         started        signatures6 process7 file8 47 C:\Users\user\...\Stikprvevarianterne204.exe, PE32 14->47 dropped 49 Stikprvevariantern...exe:Zone.Identifier, ASCII 14->49 dropped 77 Found many strings related to Crypto-Wallets (likely being stolen) 14->77 79 Writes to foreign memory regions 14->79 81 Found suspicious powershell code related to unpacking or dynamic code loading 14->81 83 Powershell drops PE file 14->83 18 Stikprvevarianterne204.exe 63 14->18         started        23 conhost.exe 14->23         started        signatures9 process10 dnsIp11 55 ccrhs.shop 172.67.195.231, 49710, 49711, 80 CLOUDFLARENETUS United States 18->55 57 novovisualcabeleireiros.com.br 167.114.197.124, 49709, 80 OVHFR Canada 18->57 31 C:\Users\user\AppData\...\vcruntime140.dll, PE32 18->31 dropped 33 C:\Users\user\AppData\Local\...\ucrtbase.dll, PE32 18->33 dropped 35 C:\Users\user\AppData\Local\...\softokn3.dll, PE32 18->35 dropped 37 45 other files (none is malicious) 18->37 dropped 67 Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc) 18->67 69 Tries to steal Instant Messenger accounts or passwords 18->69 71 Tries to steal Mail credentials (via file / registry access) 18->71 73 6 other signatures 18->73 25 cmd.exe 1 18->25         started        file12 signatures13 process14 process15 27 conhost.exe 25->27         started        29 timeout.exe 1 25->29         started       
Score:
100%
Verdict:
Malware
File Type:
PE
Link:
https://malprob.io/report/94d77da6e9ba6786e66b3864a9092a028d4e076774a5003b50eea0b5b04be074
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/94d77da6e9ba6786e66b3864a9092a028d4e076774a5003b50eea0b5b04be074/
Threat name:
Win32.Trojan.Generic
Create hunting rule
Status:
Malicious
First seen:
2024-07-17 12:21:06 UTC
File Type:
PE (Exe)
Extracted files:
11
AV detection:
22 of 38 (57.89%)
Threat level:
  2/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=stlx3jxjxjtynztlhbskscjkakgu4b3hossqao2q52qllmcl4b2a._file
Verdict:
unknown
Result
Malware family:
azorult
Create hunting rule
Score:
  10/10
Tags:
family:azorult collection discovery execution infostealer spyware stealer trojan
Link:
https://tria.ge/reports/240717-pjbl2atcjf/
Behaviour
Checks processor information in registry
Delays execution with timeout.exe
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: MapViewOfSection
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
outlook_office_path
outlook_win_path
NSIS installer
Enumerates physical storage devices
Program crash
Drops file in Program Files directory
Drops file in Windows directory
Suspicious use of NtCreateThreadExHideFromDebugger
Suspicious use of NtSetInformationThreadHideFromDebugger
Suspicious use of SetThreadContext
Accesses Microsoft Outlook profiles
Accesses cryptocurrency files/wallets, possible credential harvesting
Checks installed software on the system
Loads dropped DLL
Reads WinSCP keys stored on the system
Reads data files stored by FTP clients
Reads local data of messenger clients
Reads user/profile data of local email clients
Reads user/profile data of web browsers
Command and Scripting Interpreter: PowerShell
Azorult
Verdict:
Malicious
Tags:
n/a
YARA:
n/a
Link:
https://app.threat.zone/submission/5b8919b3-cb66-49f1-ba8e-627fd89d6242
Unpacked files
SH256 hash:
873fa0c52eae7cfbed56ea18b21fad0ca8f018ab7f305bd1db1a3ec454e353d1
MD5 hash:
19d3373e403a6e724cfa1563dfd1f463
SHA1 hash:
4917547b355a91e9431879209f56925097bf4fb3
Link:
https://www.unpac.me/results/238bebef-8522-4bf9-b352-46628004378c/
SH256 hash:
bcb93204bd1854d0c34fa30883bab51f6813ab32abf7fb7d4aeed21d71f6af87
MD5 hash:
6c881f00ba860b17821d8813aa34dbc6
SHA1 hash:
0e5a1e09b1ce1bc758d6977b913a8d9ccbe52a13
Link:
https://www.unpac.me/results/238bebef-8522-4bf9-b352-46628004378c/
SH256 hash:
95042dbe7428461ee7fd210acf37040eb921012c7b32f66cb54766f0a16bb5b6
MD5 hash:
49998d066af103d06b56f5b4c76b1497
SHA1 hash:
b7dce166147f40dfa17f5ca950c4e324a10d04be
Link:
https://www.unpac.me/results/238bebef-8522-4bf9-b352-46628004378c/
SH256 hash:
832da3cff792135ecb98f44c387bea3a8e2e9bd096b917303ca8b9dc71d60365
MD5 hash:
50a9396a761bf245ed4df1b08782d6f2
SHA1 hash:
e01a99100e91801abe074341b0c77cca6220f0bd
Link:
https://www.unpac.me/results/238bebef-8522-4bf9-b352-46628004378c/
SH256 hash:
94d77da6e9ba6786e66b3864a9092a028d4e076774a5003b50eea0b5b04be074
MD5 hash:
6b67c037861d71932f9971faade3c695
SHA1 hash:
03313a12f94a0923bd456a058bb974e43f3c8562
Link:
https://www.unpac.me/results/238bebef-8522-4bf9-b352-46628004378c/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/94d77da6e9ba6786e66b3864a9092a028d4e076774a5003b50eea0b5b04be074

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:Ins_NSIS_Buer_Nov_2020_1
Create hunting rule
Author:Arkbird_SOLG
Description:Detect NSIS installer used for Buer loader
Rule name:NSIS_April_2024
Create hunting rule
Author:NDA0N
Description:Detects NSIS installers
Rule name:NSIS_GuLoader
Create hunting rule
Author:NDA0E
Description:Detects GuLoader using NSIS
Rule name:NSIS_GuLoader_July_2024
Create hunting rule
Author:NDA0E
Description:Detects GuLoader packed with NSIS installer
Rule name:shellcode
Create hunting rule
Author:nex
Description:Matched shellcode byte patterns

File information

The table below shows additional information about this malware sample such as delivery method and external references.

BLint

The following table provides more information about this file using BLint. BLint is a Binary Linter to check the security properties, and capabilities in executables.

Findings
IDTitleSeverity
CHECK_AUTHENTICODEMissing Authenticodehigh
CHECK_DLL_CHARACTERISTICSMissing dll Security Characteristics (HIGH_ENTROPY_VA)high
Reviews
IDCapabilitiesEvidence
COM_BASE_APICan Download & Execute componentsole32.dll::CoCreateInstance
SECURITY_BASE_APIUses Security Base APIADVAPI32.dll::AdjustTokenPrivileges
SHELL_APIManipulates System ShellSHELL32.dll::ShellExecuteExA
SHELL32.dll::SHFileOperationA
SHELL32.dll::SHGetFileInfoA
WIN32_PROCESS_APICan Create Process and ThreadsKERNEL32.dll::CreateProcessA
ADVAPI32.dll::OpenProcessToken
KERNEL32.dll::CloseHandle
KERNEL32.dll::CreateThread
WIN_BASE_APIUses Win Base APIKERNEL32.dll::LoadLibraryExA
KERNEL32.dll::GetDiskFreeSpaceA
KERNEL32.dll::GetCommandLineA
WIN_BASE_IO_APICan Create FilesKERNEL32.dll::CopyFileA
KERNEL32.dll::CreateDirectoryA
KERNEL32.dll::CreateFileA
KERNEL32.dll::DeleteFileA
KERNEL32.dll::MoveFileA
KERNEL32.dll::MoveFileExA
WIN_BASE_USER_APIRetrieves Account InformationADVAPI32.dll::LookupPrivilegeValueA
WIN_REG_APICan Manipulate Windows RegistryADVAPI32.dll::RegCreateKeyExA
ADVAPI32.dll::RegDeleteKeyA
ADVAPI32.dll::RegOpenKeyExA
ADVAPI32.dll::RegQueryValueExA
ADVAPI32.dll::RegSetValueExA
WIN_USER_APIPerforms GUI ActionsUSER32.dll::AppendMenuA
USER32.dll::EmptyClipboard
USER32.dll::FindWindowExA
USER32.dll::OpenClipboard
USER32.dll::PeekMessageA
USER32.dll::CreateWindowExA

Comments