MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 b594ae37dfb90a402bda0803680b455ababcc67e1add26f3c3f8f192d97dbe2a. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AZORult


Vendor detections: 14


Intelligence 14 IOCs 2 YARA 7 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: b594ae37dfb90a402bda0803680b455ababcc67e1add26f3c3f8f192d97dbe2a
SHA3-384 hash: 0dc8072d39e1f0159842c1a33208cfbb6fa994862950a0c6625db243fc96e71324210ac5ea7ec01af5e0e89a7709ab98
SHA1 hash: 849a5bfbfdc16cad6c10edbaadcc4bad71756620
MD5 hash: be1aaef37143496d75cb83643ff63f8c
humanhash: mountain-massachusetts-paris-item
File name:be1aaef37143496d75cb83643ff63f8c.exe
Download: download sample
Signature AZORult
Create hunting rule
File size:991'232 bytes
First seen:2021-09-02 15:11:10 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash ca357d1c9b605d95e9d31e67e1c53033 (6 x AZORult, 2 x RaccoonStealer, 1 x NetWire)
ssdeep 24576:waR0NC7TnVeuFVVo2f1sSu/3WxF0ZSFgazrw7bYOggrF0dz+QgAgL:waWNC7hLVVL1sX3WxKZKgW2hrKd7jE
Threatray 7'772 similar samples on MalwareBazaar
TLSH T1F225010A6D6A0983F01649B14BD595F40B7EBC33B1819E0FFB45B90809F2AD66CE1B77
Reporter abuse_ch
Tags:AZORult exe


Avatar
abuse_ch
AZORult C2:
http://5.181.156.221/

Indicators Of Compromise (IOCs)

Below is a list of indicators of compromise (IOCs) associated with this malware samples.

IOCThreatFox Reference
http://5.181.156.221/ https://threatfox.abuse.ch/ioc/213378/
http://mazoyer.ac.ug/index.php https://threatfox.abuse.ch/ioc/213380/

Intelligence

File Origin
# of uploads :
1
# of downloads :
1'033
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
be1aaef37143496d75cb83643ff63f8c.exe
Verdict:
Malicious activity
Analysis date:
2021-09-02 15:24:36 UTC
Tags:
trojan stealer vidar rat azorult raccoon loader
Link:
https://app.any.run/tasks/fd8e2653-db47-48d8-aa0d-c8b5cf187eb3

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
Vidar
Create hunting rule
Link:
https://www.capesandbox.com/analysis/184833/
Detection(s):
SecuriteInfo.com.Trojan.Siggen14.62490.22654.29460.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
Creating a file in the %temp% directory
Creating a process from a recently created file
Sending a UDP request
Malware family:
AZORult
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/d2138c47-97c3-408e-b097-fc4b155554ba
Result
Threat name:
Azorult Vidar
Create hunting rule
Detection:
malicious
Classification:
phis.troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/844137
Signature
Antivirus / Scanner detection for submitted sample
Found many strings related to Crypto-Wallets (likely being stolen)
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
Maps a DLL or memory area into another process
Multi AV Scanner detection for submitted file
Self deletion via cmd delete
Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)
Tries to harvest and steal Bitcoin Wallet information
Tries to harvest and steal browser information (history, passwords, etc)
Tries to harvest and steal ftp login credentials
Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)
Tries to steal Crypto Currency Wallets
Tries to steal Instant Messenger accounts or passwords
Tries to steal Mail credentials (via file access)
Yara detected Azorult
Yara detected Azorult Info Stealer
Yara detected Vidar stealer
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 476572 Sample: fOUyk9Zj9i.exe Startdate: 02/09/2021 Architecture: WINDOWS Score: 100 83 Snort IDS alert for network traffic (e.g. based on Emerging Threat rules) 2->83 85 Malicious sample detected (through community Yara rule) 2->85 87 Antivirus / Scanner detection for submitted sample 2->87 89 6 other signatures 2->89 9 fOUyk9Zj9i.exe 16 2->9         started        process3 file4 71 C:\Users\user\AppData\Local\Temp\vcxfse.exe, PE32 9->71 dropped 73 C:\Users\user\AppData\Local\Temp\cbvjns.exe, PE32 9->73 dropped 101 Self deletion via cmd delete 9->101 103 Maps a DLL or memory area into another process 9->103 13 cbvjns.exe 4 9->13         started        16 fOUyk9Zj9i.exe 83 9->16         started        20 vcxfse.exe 4 9->20         started        signatures5 process6 dnsIp7 105 Maps a DLL or memory area into another process 13->105 22 cbvjns.exe 67 13->22         started        75 5.181.156.221, 49740, 49745, 80 MIVOCLOUDMD Moldova Republic of 16->75 77 telete.in 195.201.225.248, 443, 49739 HETZNER-ASDE Germany 16->77 47 C:\Users\user\AppData\LocalLow\sqlite3.dll, PE32 16->47 dropped 49 C:\Users\user\AppData\...\vcruntime140.dll, PE32 16->49 dropped 51 C:\Users\user\AppData\...\ucrtbase.dll, PE32 16->51 dropped 53 56 other files (none is malicious) 16->53 dropped 107 Tries to steal Mail credentials (via file access) 16->107 109 Self deletion via cmd delete 16->109 27 cmd.exe 16->27         started        29 vcxfse.exe 191 20->29         started        file8 signatures9 process10 dnsIp11 55 C:\Users\user\AppData\...\vcruntime140.dll, PE32 22->55 dropped 57 C:\Users\user\AppData\Local\...\ucrtbase.dll, PE32 22->57 dropped 59 C:\Users\user\AppData\Local\...\softokn3.dll, PE32 22->59 dropped 67 45 other files (none is malicious) 22->67 dropped 91 Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc) 22->91 93 Tries to steal Instant Messenger accounts or passwords 22->93 95 Tries to steal Mail credentials (via file access) 22->95 99 3 other signatures 22->99 31 cmd.exe 22->31         started        33 conhost.exe 27->33         started        35 timeout.exe 27->35         started        79 mazoyer.ac.ug 185.215.113.77, 49738, 49743, 49744 WHOLESALECONNECTIONSNL Portugal 29->79 81 mazooyaar.ac.ug 29->81 61 C:\ProgramData\vcruntime140.dll, PE32 29->61 dropped 63 C:\ProgramData\sqlite3.dll, PE32 29->63 dropped 65 C:\ProgramData\softokn3.dll, PE32 29->65 dropped 69 4 other files (none is malicious) 29->69 dropped 97 Tries to steal Crypto Currency Wallets 29->97 37 cmd.exe 29->37         started        file12 signatures13 process14 process15 39 conhost.exe 31->39         started        41 timeout.exe 31->41         started        43 conhost.exe 37->43         started        45 taskkill.exe 37->45         started       
Detection:
azorult
Create hunting rule
Link:
https://mwdb.cert.pl/sample/b594ae37dfb90a402bda0803680b455ababcc67e1add26f3c3f8f192d97dbe2a/
Threat name:
Win32.Trojan.Remcos
Create hunting rule
Status:
Malicious
First seen:
2021-09-02 15:12:06 UTC
AV detection:
20 of 28 (71.43%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=wwkk4n67xefeak62babwqc2flk5lzrt6dlosn46d7dyzfwl5xyva._file
Verdict:
malicious
Label(s):
azorult
Create hunting rule
Similar samples:
14a0d25b4d33216e9110c9588fa3168105efdad28827e772c4798337544eb708
AZORult
1b9339d0a70cdef37f4827a81100f9e8158a5633dc8b7a2c3b616f070ce49b5d
AZORult
1eb39c14abcac667ca35cf294bfda8ac6282b93028d830f1665afa2a87cff4ef
AZORult
29cf2aec62c3504b1914484feff17ae470b51229b1df06f1a30334a08b6db12a
AZORult
3bdaeb542939de272d46fa125a9fbfc4a2bb551c3a49c5fbb68d17c45a11446d
AZORult
547bf6d6ed5ae181513ed653109514c73e5f50c3ea3a094bcd382fbd3c4b4bb0
AZORult
5e08ef6445c40ba0c1216c04291b0d9ef48f0983a9aebd25f214e6fc988daa53
AZORult
9d4a0a8ffa11fc953750c07bd6997bcd23871fe277f65b4113e197b779aa24f0
AZORult
b7f7c6607354a0b83caccf57efef2d2447d212b7e0ee0f476abf069274cfd90c
AZORult
fa40dc2c8055f953099d7d354ba97fbf3a5f3aa501ce95cb8cefa810b80ea5d4
AZORult
+ 7'762 additional samples on MalwareBazaar
Result
Malware family:
raccoon
Create hunting rule
Score:
  10/10
Tags:
family:azorult family:oski family:raccoon botnet:43aae292cfe6f58a13bd7111bdd7d5ded5b23ec3 discovery infostealer spyware stealer suricata trojan
Link:
https://tria.ge/reports/210902-sk614sdeer/
Behaviour
Checks processor information in registry
Delays execution with timeout.exe
Kills process with taskkill
Modifies system certificate store
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: MapViewOfSection
Suspicious use of AdjustPrivilegeToken
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Suspicious use of SetThreadContext
Accesses cryptocurrency files/wallets, possible credential harvesting
Checks installed software on the system
Deletes itself
Loads dropped DLL
Reads data files stored by FTP clients
Reads local data of messenger clients
Reads user/profile data of local email clients
Reads user/profile data of web browsers
Downloads MZ/PE file
Executes dropped EXE
Azorult
Oski
Raccoon
suricata: ET MALWARE Suspicious Zipped Filename in Outbound POST Request (Passwords.txt)
suricata: ET MALWARE Vidar/Arkei/Megumin/Oski Stealer Data Exfil
suricata: ET MALWARE Win32/AZORult V3.3 Client Checkin M16
suricata: ET MALWARE Win32/AZORult V3.3 Client Checkin M3
Malware Config
C2 Extraction:
mazooyaar.ac.ug
http://195.245.112.115/index.php
Unpacked files
SH256 hash:
e62783f703c07f2f029466f481776503657c47a3459dab626187a470db4f9237
MD5 hash:
e46ee59234adc695a2ea384233d8e56e
SHA1 hash:
2d654169a0b2d3f62a6909500db87bf55b3dc124
Detections:
win_raccoon_auto
Create hunting rule
Link:
https://www.unpac.me/results/8fba9b6a-7481-4c81-b740-bc73b494ab74/
Parent samples :
b594ae37dfb90a402bda0803680b455ababcc67e1add26f3c3f8f192d97dbe2a
93ddf61c1aa7c0b867ffbd579b9febdeed4b027d14f8b86d62f7da493706731c
SH256 hash:
6d418713b5aadd1005385fc454052e6f0cccc217d7a4be3b7f55df92f4b2d487
MD5 hash:
e3d0b12ea87d328d8e9964fcaa93e78c
SHA1 hash:
3721e1f20d5169797dc9b890d532b69acbaf7bfa
Detections:
win_azorult_g1
Create hunting rule
win_azorult_auto
Create hunting rule
Link:
https://www.unpac.me/results/8fba9b6a-7481-4c81-b740-bc73b494ab74/
SH256 hash:
c0f09be2d1262a8bce373f1eea478e2649fa7ce344b75a3f6597c8a696d1fbc2
MD5 hash:
48943c20ef341cb0345e37a22106f024
SHA1 hash:
4c5f2ec1c5b1d397056074ed77889bfba61f5925
Detections:
win_oski_g0
Create hunting rule
win_oski_auto
Create hunting rule
Link:
https://www.unpac.me/results/8fba9b6a-7481-4c81-b740-bc73b494ab74/
SH256 hash:
b594ae37dfb90a402bda0803680b455ababcc67e1add26f3c3f8f192d97dbe2a
MD5 hash:
be1aaef37143496d75cb83643ff63f8c
SHA1 hash:
849a5bfbfdc16cad6c10edbaadcc4bad71756620
Link:
https://www.unpac.me/results/8fba9b6a-7481-4c81-b740-bc73b494ab74/
Malware family:
Raccoon v1.7.2
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/b594ae37dfb9/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/b594ae37dfb90a402bda0803680b455ababcc67e1add26f3c3f8f192d97dbe2a

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:Azorult
Create hunting rule
Author:JPCERT/CC Incident Response Group
Description:detect Azorult in memory
Reference:internal research
Rule name:INDICATOR_SUSPICIOUS_EXE_Referenfces_Messaging_Clients
Create hunting rule
Author:ditekSHen
Description:Detects executables referencing many email and collaboration clients. Observed in information stealers
Rule name:MALWARE_Win_Vidar
Create hunting rule
Author:ditekSHen
Description:Detects Vidar / ArkeiStealer
Rule name:Vidar
Create hunting rule
Author:kevoreilly
Description:Vidar Payload
Rule name:win_azorult_auto
Create hunting rule
Author:Felix Bilstein - yara-signator at cocacoding dot com
Description:Detects win.azorult.
Rule name:win_oski_auto
Create hunting rule
Author:Felix Bilstein - yara-signator at cocacoding dot com
Description:Detects win.oski.
Rule name:win_raccoon_auto
Create hunting rule
Author:Felix Bilstein - yara-signator at cocacoding dot com
Description:Detects win.raccoon.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

AZORult

Executable exe b594ae37dfb90a402bda0803680b455ababcc67e1add26f3c3f8f192d97dbe2a

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/399075/
  
Delivery method
Distributed via web download
Cape
Cape
https://www.capesandbox.com/analysis/184833/
  
URLhaus
https://urlhaus.abuse.ch/url/446434/
  
URLhaus
https://urlhaus.abuse.ch/url/1514315/
  
URLhaus
https://urlhaus.abuse.ch/url/437013/
  
URLhaus
https://urlhaus.abuse.ch/url/265919/
  
URLhaus
https://urlhaus.abuse.ch/url/1514297/
  
URLhaus
https://urlhaus.abuse.ch/url/1539388/

Comments