MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 cb50638ad62a7d2fe8719d31319a698ec91d9b7ffe7498e0ec1d3b36d81dedf3. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	cb50638ad62a7d2fe8719d31319a698ec91d9b7ffe7498e0ec1d3b36d81dedf3
SHA3-384 hash:	5f762aa29530f173a2d8ab5e3766fb8a8707a90861cf58c5b0ae21d8d1e6b0cc5e3a33c50dbb132527815771ec23db4d
SHA1 hash:	a8dc3390833a6031a2043c9d38722aeee25341b3
MD5 hash:	8fd6fd774a87b26e6c1fdb440c669768
humanhash:	tennis-lima-seven-coffee
File name:	C&A AW23 Orders Info.exe
Download:	download sample
Signature	AZORult Alert Create hunting rule
File size:	317'057 bytes
First seen:	2023-05-13 08:35:13 UTC
Last seen:	2023-05-16 15:49:04 UTC
File type:	exe
MIME type:	application/x-dosexec
imphash	59a4a44a250c4cf4f2d9de2b3fe5d95f (70 x GuLoader, 13 x AgentTesla, 7 x AZORult)
ssdeep	6144:fDpoe8dhzfwRiQ8RwwDtmFR6y6V1C2SNqFpLa3R:uzIADtmsi2hLw
Threatray	651 similar samples on MalwareBazaar
TLSH	T1E064BE83F88086D1E8F88A3224F6093F937F7E7A8957570F264CBBB51DF31426616586
TrID	92.7% (.EXE) NSIS - Nullsoft Scriptable Install System (846567/2/133) 3.4% (.EXE) Win32 Executable MS Visual C++ (generic) (31206/45/13) 1.1% (.EXE) Win64 Executable (generic) (10523/12/4) 0.7% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2) 0.5% (.EXE) Win16 NE executable (generic) (5038/12/1)
File icon (PE):
dhash icon	04cce2b88cf839c2 (7 x AZORult, 1 x Formbook, 1 x GuLoader)
Reporter	abuse_ch
Tags:	AZORult exe

abuse_ch

AZORult C2:
http://dblg023.shop/PL341/index.php

Intelligence

---

File Origin

# of uploads :

2

# of downloads :

454

Origin country :

NL

Vendor Threat Intelligence

ANY.RUN Malicious

Malware family:

n/a

ID:

1

File name:

C&A AW23 Orders Info.exe

Verdict:

Malicious activity

Analysis date:

2023-05-13 08:35:55 UTC

Tags:

installer

Link:

https://app.any.run/tasks/81ea3a14-5006-4031-ab5a-eff754ec9555

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

CAPE Sandbox

Detection:

n/a

Link:

https://www.capesandbox.com/analysis/388891/

ClamAV Detected

Detection(s):

SecuriteInfo.com.ADWARE.Adware.Gen.171.UNOFFICIAL

Alert

Create hunting rule

Dr. Web vxCube Clean

Result

Verdict:

Clean

Maliciousness:

Behaviour

Searching for the window

Creating a file in the %temp% directory

Creating a window

Creating a file

Delayed reading of the file

Sending a custom TCP request

FileScan.IO Suspicious

Verdict:

Suspicious

Threat level:

  5/10

Confidence:

100%

Tags:

azorult overlay packed shell32.dll

Link:

https://www.filescan.io/uploads/645f4bf4e68f9cbce80c1d5a/reports/dea36e8f-6851-4d56-8f15-4bc8995c0787/overview

Hybrid Analysis Win/malicious_confidence_70%

Verdict:

Malicious

Labled as:

Win/malicious_confidence_70%

Link:

https://www.hybrid-analysis.com/sample/cb50638ad62a7d2fe8719d31319a698ec91d9b7ffe7498e0ec1d3b36d81dedf3

InQuest MALICIOUS

Result

Verdict:

MALICIOUS

Details

Windows PE Executable

Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.

Intezer Unknown

Verdict:

Unknown

Link:

https://analyze.intezer.com/analyses/1a50a538-5a8c-4123-8129-0dd7c200230c

Joe Sandbox GuLoader, Azorult

Result

Threat name:

GuLoader, Azorult

Alert

Create hunting rule

Detection:

malicious

Classification:

troj.evad.phis.spyw

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/1232082

Signature

Antivirus detection for URL or domain

Found many strings related to Crypto-Wallets (likely being stolen)

Initial sample is a PE file and has a suspicious name

Multi AV Scanner detection for domain / URL

Multi AV Scanner detection for submitted file

Self deletion via cmd or bat file

Snort IDS alert for network traffic

Tries to detect Any.run

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Tries to harvest and steal Bitcoin Wallet information

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal ftp login credentials

Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)

Tries to steal Crypto Currency Wallets

Tries to steal Instant Messenger accounts or passwords

Tries to steal Mail credentials (via file / registry access)

Yara detected Azorult

Yara detected GuLoader

Behaviour

Behavior Graph:

Download SVG

CERT.PL MWDB

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/cb50638ad62a7d2fe8719d31319a698ec91d9b7ffe7498e0ec1d3b36d81dedf3/

ReversingLabs TitaniumCloud Win32.Trojan.Generic

Threat name:

Win32.Trojan.Generic

Alert

Create hunting rule

Status:

Suspicious

First seen:

2023-05-13 08:36:09 UTC

File Type:

PE (Exe)

Extracted files:

8

AV detection:

13 of 24 (54.17%)

Threat level:

  5/5

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=znighcwwfj6s72drtuytdgtjr3er3g377z2jryhmdu5tnwa55xzq._file

Threatray azorult cloudeye

Verdict:

malicious

Label(s):

azorult

Alert

Create hunting rule

cloudeye

Alert

Create hunting rule

Similar samples:

213be309e9885ffee1f6dff8cbdc8527d22a0813105cb565dddb727b0d74ff6f

AZORult

29ef762fd2115e70a9983833788d592be9b846e52e79066341849281067cd57b

AZORult

3fbb047dafd852970c75fe510d4f6b5f0e03ca4cda1f3f8d75764a5103371723

AZORult

79c7450a5d20a4696943cb3dfb2d406c7d421310c8c408d1ab1e0491a5c13dc4

AZORult

9c722c514957d12d17827e852388207f766c60385c434d4888f5872f0870d485

AZORult

b5083c2bb6ce06175d3455c77a514d9fd48150aaf8c6fe6159c33f46b0a5b11e

AZORult

bb66c3fabdbf663545fbd44331a0b4c7031ea94082b8a47c4243b1d65cb9d8a4

AZORult

eeeb1bc5faafbb0921895d6b2bba4d0dce0ef5288e4b22e3eb6ec329b3ef7c6a

AZORult

+ 641 additional samples on MalwareBazaar

Hatching Triage guloader

Result

Malware family:

guloader

Alert

Create hunting rule

Score:

  10/10

Tags:

family:azorult family:guloader downloader infostealer trojan

Link:

https://tria.ge/reports/230513-khkq4aab3v/

Behaviour

Delays execution with timeout.exe

Enumerates physical storage devices

Loads dropped DLL

Azorult

Guloader,Cloudeye

Malware Config

C2 Extraction:

http://dblg023.shop/PL341/index.php

UnpacMe 2

Unpacked files

SH256 hash:

75ed40311875312617d6711baed0be29fcaee71031ca27a8d308a72b15a51e49

MD5 hash:

a436db0c473a087eb61ff5c53c34ba27

SHA1 hash:

65ea67e424e75f5065132b539c8b2eda88aa0506

Link:

https://www.unpac.me/results/00864285-0f02-4688-ae24-3b95c5b4cf5f/

SH256 hash:

cb50638ad62a7d2fe8719d31319a698ec91d9b7ffe7498e0ec1d3b36d81dedf3

MD5 hash:

8fd6fd774a87b26e6c1fdb440c669768

SHA1 hash:

a8dc3390833a6031a2043c9d38722aeee25341b3

Link:

https://www.unpac.me/results/00864285-0f02-4688-ae24-3b95c5b4cf5f/

VMRay GuLoader

Malware family:

GuLoader

Alert

Create hunting rule

Verdict:

Malicious

Link:

https://www.vmray.com/analyses/_mb/cb50638ad62a/report/overview.html

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

YOROI YOMI Azorult

Threat name:

Azorult

Score:

0.90

Link:

https://yomi.yoroi.company/submissions/cb50638ad62a7d2fe8719d31319a698ec91d9b7ffe7498e0ec1d3b36d81dedf3

File information

---

The table below shows additional information about this malware sample such as delivery method and external references.

Cape

https://www.capesandbox.com/analysis/388891/