🤲🏼 NEW | abuse.ch Community Hub! Earn recognition 🏅 for the malware intelligence you share, climb the leaderboards 📈, and connect with like-minded contributors who share your hunting focus 🤝. Ready to unlock your profile? Go to the Community Hub →

MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 b5c538f89ca2e3d9a8085bc387d85f7f50e9470975ffec25fe040c26226beccb. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AZORult


Vendor detections: 19


Intelligence 19 IOCs 1 YARA 4 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: b5c538f89ca2e3d9a8085bc387d85f7f50e9470975ffec25fe040c26226beccb
SHA3-384 hash: c20d3759906d2d00aa180031535b34cbb049c53f00cd1e58b7b72956cdc699f83e3145a9f8318918da685ddc99a9bf35
SHA1 hash: d854a2cb11b56d64dd7f87ee91ea47f305ce82bf
MD5 hash: 7958c012f2efc42cc7ff436d3377abcc
humanhash: purple-five-purple-sad
File name:MUH030425.exe
Download: download sample
Signature AZORult
Create hunting rule
File size:1'656'320 bytes
First seen:2025-03-04 08:30:20 UTC
Last seen:2025-03-04 09:48:16 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (49'234 x AgentTesla, 20'488 x Formbook, 12'372 x SnakeKeylogger)
ssdeep 24576:LRHEylAISaG3TreXIKnd92qNEf8Gags7a4/2yaVe:VH98d3Trwnd9BEf8GahQ4
Threatray 11 similar samples on MalwareBazaar
TLSH T161757B10BF5D6215E92C39FD6A66867716322E16A904F1EAE038730E9D31217CF3739E
TrID 71.1% (.EXE) Generic CIL Executable (.NET, Mono, etc.) (73123/4/13)
10.2% (.EXE) Win64 Executable (generic) (10522/11/4)
6.3% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
4.3% (.EXE) Win32 Executable (generic) (4504/4/1)
2.0% (.ICL) Windows Icons Library (generic) (2059/9)
Magika pebin
dhash icon 094acb1609217567 (4 x SnakeKeylogger, 3 x AZORult, 1 x MassLogger)
Reporter abuse_ch
Tags:AZORult exe


Avatar
abuse_ch
AZORult C2:
http://k1d5.icu/TP341/index.php

Indicators Of Compromise (IOCs)

Below is a list of indicators of compromise (IOCs) associated with this malware samples.

IOCThreatFox Reference
http://k1d5.icu/TP341/index.php https://threatfox.abuse.ch/ioc/1440747/

Intelligence

File Origin
# of uploads :
2
# of downloads :
534
Origin country :
NL NL
Vendor Threat Intelligence
Malware family:
azorult
Create hunting rule
ID:
1
File name:
MUH030425.exe
Verdict:
Malicious activity
Analysis date:
2025-03-04 08:39:42 UTC
Tags:
m0yv stealer azorult sinkhole loader
Link:
https://app.any.run/tasks/85bf7912-fea4-4a73-b94d-c62f93b9cfb1

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection(s):
SecuriteInfo.com.Win32.TrojanX-gen.21372.28145.UNOFFICIAL
Create hunting rule

Verdict:
Malicious
Score:
94.1%
Link:
https://cyber-fortress.com/docs/result/index.php?id=67c6bb2fc668b65489bee4cb
Tags:
virus shell msil
Result
Verdict:
Malware
Maliciousness:

Behaviour
Searching for the window
Creating a window
Сreating synchronization primitives
Creating a process with a hidden window
Creating a file in the %AppData% directory
Enabling the 'hidden' option for recently created files
Adding an access-denied ACE
Creating a file in the %temp% directory
Launching a process
Creating a file
Searching for synchronization primitives
Modifying an executable file
Adding an exclusion to Microsoft Defender
Enabling autorun by creating a file
Unauthorized injection to a system process
Infecting executable files
Verdict:
Suspicious
Threat level:
  5/10
Confidence:
100%
Tags:
obfuscated obfuscated packed packed packer_detected vbnet
Link:
https://www.filescan.io/uploads/67c6ba2a3c5f644bd941e1bf/reports/c19b1145-2337-4b8a-988b-13330ee2c20c/overview
Verdict:
Malicious
Labled as:
IL:Trojan.MSILZilla
Link:
https://www.hybrid-analysis.com/sample/b5c538f89ca2e3d9a8085bc387d85f7f50e9470975ffec25fe040c26226beccb
Malware family:
Expiro
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/db2d3362-4c0e-42e0-9367-1aee301421cb
Result
Threat name:
Azorult
Create hunting rule
Detection:
malicious
Classification:
spre.phis.troj.spyw.expl.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1628929
Signature
.NET source code contains potential unpacker
Adds a directory exclusion to Windows Defender
Antivirus detection for dropped file
Antivirus detection for URL or domain
C2 URLs / IPs found in malware configuration
Contains functionality to behave differently if execute on a Russian/Kazak computer
Creates files in the system32 config directory
Creates files inside the volume driver (system volume information)
Drops executable to a common third party application directory
Found direct / indirect Syscall (likely to bypass EDR)
Found malware configuration
Found many strings related to Crypto-Wallets (likely being stolen)
Infects executable files (exe, dll, sys, html)
Joe Sandbox ML detected suspicious sample
Loading BitLocker PowerShell Module
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for submitted file
Queries random domain names (often used to prevent blacklisting and sinkholes)
Sigma detected: Powershell Base64 Encoded MpPreference Cmdlet
Sigma detected: Scheduled temp file as task from temp location
Suricata IDS alerts for network traffic
Tries to harvest and steal Bitcoin Wallet information
Tries to harvest and steal browser information (history, passwords, etc)
Tries to harvest and steal ftp login credentials
Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)
Tries to steal Crypto Currency Wallets
Tries to steal Instant Messenger accounts or passwords
Tries to steal Mail credentials (via file / registry access)
Uses schtasks.exe or at.exe to add and modify task schedules
Yara detected AntiVM3
Yara detected Azorult
Yara detected Azorult Info Stealer
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1628929 Sample: MUH030425.exe Startdate: 04/03/2025 Architecture: WINDOWS Score: 100 69 ww7.przvgke.biz 2->69 71 ww7.fwiwk.biz 2->71 73 88 other IPs or domains 2->73 87 Suricata IDS alerts for network traffic 2->87 89 Found malware configuration 2->89 91 Malicious sample detected (through community Yara rule) 2->91 93 13 other signatures 2->93 9 alg.exe 2->9         started        14 MUH030425.exe 7 2->14         started        16 TieringEngineService.exe 2->16         started        18 20 other processes 2->18 signatures3 process4 dnsIp5 81 dlynankz.biz 85.214.228.140, 49781, 80 STRATOSTRATOAGDE Germany 9->81 83 gjogvvpsf.biz 208.117.43.225, 49755, 49763, 49805 STEADFASTUS United States 9->83 85 11 other IPs or domains 9->85 55 C:\Program Files\...\updater.exe, PE32+ 9->55 dropped 57 C:\Program Files\...\private_browsing.exe, PE32+ 9->57 dropped 59 C:\Program Files\...\plugin-container.exe, PE32+ 9->59 dropped 67 131 other malicious files 9->67 dropped 105 Creates files in the system32 config directory 9->105 107 Drops executable to a common third party application directory 9->107 109 Infects executable files (exe, dll, sys, html) 9->109 61 C:\Users\user\AppData\Roaming\wBBaygjR.exe, PE32 14->61 dropped 63 C:\Users\user\AppData\Local\...\tmpD1E0.tmp, XML 14->63 dropped 65 C:\Users\user\AppData\...\MUH030425.exe.log, ASCII 14->65 dropped 111 Uses schtasks.exe or at.exe to add and modify task schedules 14->111 113 Adds a directory exclusion to Windows Defender 14->113 20 RegSvcs.exe 64 14->20         started        25 powershell.exe 23 14->25         started        27 powershell.exe 23 14->27         started        29 2 other processes 14->29 115 Creates files inside the volume driver (system volume information) 16->115 117 Contains functionality to behave differently if execute on a Russian/Kazak computer 16->117 119 Found direct / indirect Syscall (likely to bypass EDR) 18->119 file6 signatures7 process8 dnsIp9 75 k1d5.icu 104.21.96.1, 49707, 49722, 80 CLOUDFLARENETUS United States 20->75 77 fwiwk.biz 72.52.178.23, 49715, 49719, 49749 LIQUIDWEBUS United States 20->77 79 6 other IPs or domains 20->79 45 C:\Windows\System32\wbengine.exe, PE32+ 20->45 dropped 47 C:\Windows\System32\wbem\WmiApSrv.exe, PE32+ 20->47 dropped 49 C:\Windows\System32\vds.exe, PE32+ 20->49 dropped 53 81 other malicious files 20->53 dropped 95 Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc) 20->95 97 Tries to steal Instant Messenger accounts or passwords 20->97 99 Tries to steal Mail credentials (via file / registry access) 20->99 103 7 other signatures 20->103 31 cmd.exe 20->31         started        101 Loading BitLocker PowerShell Module 25->101 33 conhost.exe 25->33         started        35 WmiPrvSE.exe 25->35         started        37 conhost.exe 27->37         started        51 C:\ProgramData\Microsoft\...\Report.wer, Unicode 29->51 dropped 39 conhost.exe 29->39         started        file10 signatures11 process12 process13 41 conhost.exe 31->41         started        43 timeout.exe 31->43         started       
Score:
98%
Verdict:
Malware
File Type:
PE
Link:
https://malprob.io/report/b5c538f89ca2e3d9a8085bc387d85f7f50e9470975ffec25fe040c26226beccb
Detection:
azorult
Create hunting rule
Link:
https://mwdb.cert.pl/sample/b5c538f89ca2e3d9a8085bc387d85f7f50e9470975ffec25fe040c26226beccb/
Threat name:
ByteCode-MSIL.Trojan.AZORult
Create hunting rule
Status:
Malicious
First seen:
2025-03-04 08:30:32 UTC
File Type:
PE (.Net Exe)
Extracted files:
38
AV detection:
22 of 38 (57.89%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=wxctr6e4ulr5tkailpbypwc7p5iosryjox76yjp6aqgcmitl5tfq._file
Verdict:
malicious
Label(s):
expiro
Create hunting rule
loader_037
Create hunting rule
Similar samples:
373b6c138897ab46738f2a8eedfa6a3d83d5186f4565514e9cd789cddc880062
AZORult
38f73caeeb18b876e4ce3f07c3b0f3b6e145ae6ff1fc0f708448e40729a17861
AZORult
7b2118ed1133b43f2521509f4eac9e89b89cdfc389208099cc6e601aaf95c836
AZORult
b1bd96341b2c06cf1ea7a1a9026222f1a85d8605798be6f7809100b3e0bd11dc
AZORult
b5c538f89ca2e3d9a8085bc387d85f7f50e9470975ffec25fe040c26226beccb
AZORult
bc77cf4119389ffce479674f64d1c365141507b4324064cd31ec78d9f3f90dc0
AZORult
error
AZORult
+ 1 additional samples on MalwareBazaar
Result
Malware family:
azorult
Create hunting rule
Score:
  10/10
Tags:
family:azorult collection credential_access discovery execution infostealer spyware stealer trojan
Link:
https://tria.ge/reports/250304-kef9havzfw/
Behaviour
outlook_win_path
outlook_office_path
Uses Volume Shadow Copy service COM API
Uses Volume Shadow Copy WMI provider
Uses Task Scheduler COM API
Suspicious use of WriteProcessMemory
Suspicious use of SetWindowsHookEx
Suspicious use of SendNotifyMessage
Suspicious use of FindShellTrayWindow
Suspicious use of AdjustPrivilegeToken
Suspicious behavior: LoadsDriver
Suspicious behavior: EnumeratesProcesses
Scheduled Task/Job: Scheduled Task
Modifies data under HKEY_USERS
Delays execution with timeout.exe
Checks processor information in registry
Checks SCSI registry key(s)
Enumerates physical storage devices
Program crash
System Location Discovery: System Language Discovery
System Network Configuration Discovery: Internet Connection Discovery
Drops file in Windows directory
Drops file in Program Files directory
Suspicious use of SetThreadContext
Drops file in System32 directory
Checks system information in the registry
Accesses cryptocurrency files/wallets, possible credential harvesting
Accesses Microsoft Outlook profiles
Unsecured Credentials: Credentials In Files
Reads user/profile data of web browsers
Reads local data of messenger clients
Loads dropped DLL
Executes dropped EXE
Checks computer location settings
Downloads MZ/PE file
Command and Scripting Interpreter: PowerShell
Azorult family
Azorult
Malware Config
C2 Extraction:
http://k1d5.icu/TP341/index.php
Verdict:
Malicious
Tags:
n/a
YARA:
n/a
Link:
https://app.threat.zone/submission/7c86bf5f-5ad8-4f63-81ca-6843a0472db7
Unpacked files
SH256 hash:
b5c538f89ca2e3d9a8085bc387d85f7f50e9470975ffec25fe040c26226beccb
MD5 hash:
7958c012f2efc42cc7ff436d3377abcc
SHA1 hash:
d854a2cb11b56d64dd7f87ee91ea47f305ce82bf
Link:
https://www.unpac.me/results/93fc4e1c-cee9-4cf6-bc3f-37135770cf37/
SH256 hash:
1d9dfc505f80eb2123e01c9e866166e0ce7fdf619a298881946dfb64cf4403e1
MD5 hash:
22236a5b880bb2d32b9a05a1ac403d6a
SHA1 hash:
1614a6831a66900f6214e0b95bcd1b9300fd8be5
Detections:
win_azorult_auto
Create hunting rule
win_azorult_g1
Create hunting rule
Azorult
Create hunting rule
Azorult
Create hunting rule
Link:
https://www.unpac.me/results/93fc4e1c-cee9-4cf6-bc3f-37135770cf37/
SH256 hash:
ea76a786edd1b1a986d7f5ab47a2582a4e7fcb1834a69ba523e1ff3d2c5965d9
MD5 hash:
68295f48eede84b9ddb6a3aa34df825c
SHA1 hash:
399c3853d40ec2ed16063f09571e530562930eeb
Detections:
SUSP_OBF_NET_ConfuserEx_Name_Pattern_Jan24
Create hunting rule
SUSP_OBF_NET_Reactor_Indicators_Jan24
Create hunting rule
Link:
https://www.unpac.me/results/93fc4e1c-cee9-4cf6-bc3f-37135770cf37/
SH256 hash:
18ec2f02a931ddec650022a9c82bb14a8f180626460f70b9db517c7f2df1d61f
MD5 hash:
8fbc028c3b3984606261d39e4537bb0c
SHA1 hash:
4cb9a560da28d72bc04512c1f4d47b2c914b16de
Link:
https://www.unpac.me/results/93fc4e1c-cee9-4cf6-bc3f-37135770cf37/
Malware family:
AZORult v3
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/b5c538f89ca2/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/b5c538f89ca2e3d9a8085bc387d85f7f50e9470975ffec25fe040c26226beccb

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:NET
Create hunting rule
Author:malware-lu
Rule name:pe_imphash
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash
Rule name:Sus_Obf_Enc_Spoof_Hide_PE
Create hunting rule
Author:XiAnzheng
Description:Check for Overlay, Obfuscating, Encrypting, Spoofing, Hiding, or Entropy Technique(can create FP)

File information

The table below shows additional information about this malware sample such as delivery method and external references.

BLint

The following table provides more information about this file using BLint. BLint is a Binary Linter to check the security properties, and capabilities in executables.

Findings
IDTitleSeverity
CHECK_AUTHENTICODEMissing Authenticodehigh
CHECK_DLL_CHARACTERISTICSMissing dll Security Characteristics (GUARD_CF)high

Comments