MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 a05edb5477d2d7455ea8055a66746c1541eb189d70cd37a2f9da3d2e2dbb1dc3. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

AZORult

Vendor detections: 15

Intelligence 15 IOCs YARA 7 File information Comments

SHA256 hash:	a05edb5477d2d7455ea8055a66746c1541eb189d70cd37a2f9da3d2e2dbb1dc3
SHA3-384 hash:	ddad2c914310c15575755b4500fbd1282ceda7cb2afcba3724baf45278a1f2e2811df378df928faf4cc3207c9a1ae50b
SHA1 hash:	6ef714929dbc886613053e6444872793f56059be
MD5 hash:	badf16b5411ab2ec95f1dd8cdbb02d8e
humanhash:	fish-seven-april-leopard
File name:	a05edb5477d2d7455ea8055a66746c1541eb189d70cd3.exe
Download:	download sample
Signature	AZORult Create hunting rule
File size:	491'520 bytes
First seen:	2023-06-01 09:50:15 UTC
Last seen:	Never
File type:	exe
MIME type:	application/x-dosexec
imphash	d94418c011c0eac4400784b86bceb5fd (1 x AZORult)
ssdeep	12288:qZ3IOfnw1bRqbMeeVBJRl31WBuA1/dTpWCw:qZ3IO4tRqbyBJvFWIA11FWCw
Threatray	176 similar samples on MalwareBazaar
TLSH	T1B2A4AE743AEBA05EF176AE3017E479E7AF7EBE733506289F8B0143074562A44C9C153A
TrID	28.5% (.EXE) Win16 NE executable (generic) (5038/12/1) 25.5% (.EXE) Win32 Executable (generic) (4505/5/1) 11.6% (.ICL) Windows Icons Library (generic) (2059/9) 11.4% (.EXE) OS/2 Executable (generic) (2029/13) 11.3% (.EXE) Generic Win/DOS Executable (2002/3)
Reporter	abuse_ch
Tags:	AZORult exe

abuse_ch

AZORult C2:
http://pcwizard.net/yz/mann/index.php

Intelligence

File Origin

# of uploads :

# of downloads :

313

Origin country :

Vendor Threat Intelligence

Malware family:

azorult

ID:

File name:

Schmitz.xls

Verdict:

Malicious activity

Analysis date:

2023-06-01 09:48:03 UTC

Tags:

macros macros-on-open opendir loader azorult

Link:

https://app.any.run/tasks/4d662a62-4acf-4556-9094-4d8f18629c0d

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

Detection:

Azorult

Link:

https://www.capesandbox.com/analysis/394324/

Detection(s):

SecuriteInfo.com.Win32.DropperX-gen.11210.23254.UNOFFICIAL

Result

Verdict:

Malware

Maliciousness:

Behaviour

Сreating synchronization primitives

Creating a window

Verdict:

Unknown

Threat level:

0/10

Confidence:

100%

Tags:

greyware lolbin packed

Link:

https://www.filescan.io/uploads/64786a088c539ae218a0a7fc/reports/4046daf1-4fd8-43e8-874e-b5fc40a835c5/overview

Verdict:

Malicious

Labled as:

Win/malicious_confidence_100%

Link:

https://www.hybrid-analysis.com/sample/a05edb5477d2d7455ea8055a66746c1541eb189d70cd37a2f9da3d2e2dbb1dc3

Malware family:

AZORult

Verdict:

Malicious

Link:

https://analyze.intezer.com/analyses/bbf55ec0-50a2-432e-841d-38624cd130fb

Result

Threat name:

AZORult

Detection:

malicious

Classification:

phis.troj.spyw.evad

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/1246675

Signature

Antivirus / Scanner detection for submitted sample

C2 URLs / IPs found in malware configuration

Contains functionality to detect sleep reduction / modifications

Detected AZORult Info Stealer

Detected unpacking (changes PE section rights)

Found malware configuration

Found many strings related to Crypto-Wallets (likely being stolen)

Machine Learning detection for sample

Malicious sample detected (through community Yara rule)

Maps a DLL or memory area into another process

Multi AV Scanner detection for submitted file

Snort IDS alert for network traffic

Tries to detect sandboxes and other dynamic analysis tools (window names)

Tries to harvest and steal Bitcoin Wallet information

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal ftp login credentials

Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)

Tries to steal Crypto Currency Wallets

Tries to steal Instant Messenger accounts or passwords

Tries to steal Mail credentials (via file / registry access)

Yara detected Azorult

Yara detected Azorult Info Stealer

Behaviour

Behavior Graph:

Download SVG

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/a05edb5477d2d7455ea8055a66746c1541eb189d70cd37a2f9da3d2e2dbb1dc3/

Threat name:

Win32.Infostealer.Azorult

Status:

Malicious

First seen:

2023-06-01 09:51:06 UTC

File Type:

PE (Exe)

AV detection:

21 of 24 (87.50%)

Threat level:

5/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=ubpnwvdx2llukxviavngm5dmcva6wge5odgtpixz3i6s4ln3dxbq._file

Verdict:

malicious

Label(s):

azorult

Result

Malware family:

azorult

Score:

10/10

Tags:

family:azorult collection discovery infostealer spyware stealer trojan

Link:

https://tria.ge/reports/230601-lvgqmsde87/

Behaviour

Checks processor information in registry

Suspicious behavior: EnumeratesProcesses

Suspicious behavior: MapViewOfSection

Suspicious use of SetWindowsHookEx

Suspicious use of WriteProcessMemory

outlook_office_path

outlook_win_path

Suspicious use of SetThreadContext

Accesses Microsoft Outlook profiles

Accesses cryptocurrency files/wallets, possible credential harvesting

Checks installed software on the system

Loads dropped DLL

Reads data files stored by FTP clients

Reads local data of messenger clients

Reads user/profile data of local email clients

Reads user/profile data of web browsers

Azorult

Malware Config

C2 Extraction:

http://pcwizard.net/yz/mann/index.php

Unpacked files

SH256 hash:

0c54b57b288f8baeab79d6d3329f41da7257135167f48541706e9c0ac1134120

MD5 hash:

4b6f60d8195faca5955e06b2004af9aa

SHA1 hash:

94c74dbcfa83777017fca768a57b8babfc2440be

Detections:

Azorult

win_azorult_auto

win_azorult_g1

Link:

https://www.unpac.me/results/77ff317a-f850-4bc7-89bd-12da0881308e/

SH256 hash:

a05edb5477d2d7455ea8055a66746c1541eb189d70cd37a2f9da3d2e2dbb1dc3

MD5 hash:

badf16b5411ab2ec95f1dd8cdbb02d8e

SHA1 hash:

6ef714929dbc886613053e6444872793f56059be

Link:

https://www.unpac.me/results/77ff317a-f850-4bc7-89bd-12da0881308e/

Malware family:

AZORult

Verdict:

Malicious

Link:

https://www.vmray.com/analyses/_mb/a05edb5477d2/report/overview.html

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/a05edb5477d2d7455ea8055a66746c1541eb189d70cd37a2f9da3d2e2dbb1dc3

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	Azorult Create hunting rule
Author:	kevoreilly
Description:	Azorult Payload

Rule name:	INDICATOR_SUSPICIOUS_EXE_References_CryptoWallets Create hunting rule
Author:	ditekSHen
Description:	Detects executables referencing many cryptocurrency mining wallets or apps. Observed in information stealers

Rule name:	meth_get_eip Create hunting rule
Author:	Willi Ballenthin

Rule name:	shellcode Create hunting rule
Author:	nex
Description:	Matched shellcode byte patterns

Rule name:	Telegram_Links Create hunting rule

Rule name:	Windows_Trojan_Azorult_38fce9ea Create hunting rule
Author:	Elastic Security

Rule name:	win_azorult_auto Create hunting rule
Author:	Felix Bilstein - yara-signator at cocacoding dot com
Description:	Detects win.azorult.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

AZORult

exe a05edb5477d2d7455ea8055a66746c1541eb189d70cd37a2f9da3d2e2dbb1dc3

(this sample)

Cape

https://www.capesandbox.com/analysis/394324/

URLhaus

https://urlhaus.abuse.ch/url/2648809/

Delivery method

Distributed via web download

Comments

Login required

You need to login to in order to write a comment. Login with your abuse.ch account.

No comments found for this malware sample