MalwareBazaar Database
You are currently viewing the MalwareBazaar entry for SHA256 cdb4f82771d838d1641a0749e9726ad77edcc91b7d34162da03f36a3d201df43. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.
Database Entry
AZORult
Vendor detections: 16
| SHA256 hash: | cdb4f82771d838d1641a0749e9726ad77edcc91b7d34162da03f36a3d201df43 |
|---|---|
| SHA3-384 hash: | 5fe97ec246d7ab5a6e3970c666aeee910a7e83b26089e80124fc86b9ad4f2184622cc535a2b72232056f5f8b5cff8390 |
| SHA1 hash: | c6044466c0f859645482f2565fad4854d0fbf586 |
| MD5 hash: | b43c38b648f6f242c023d744a3d4aced |
| humanhash: | undress-black-alanine-finch |
| File name: | b43c38b648f6f242c023d744a3d4aced.exe |
| Download: | download sample |
| Signature | AZORult |
| File size: | 362'496 bytes |
| First seen: | 2023-12-23 10:05:05 UTC |
| Last seen: | Never |
| File type: |  exe |
| MIME type: | application/x-dosexec |
| imphash | f34d5f2d4577ed6d9ceec516c1f5a744 (49'235 x AgentTesla, 20'488 x Formbook, 12'372 x SnakeKeylogger) |
| ssdeep | 6144:y0NUHxKsXA0NK8AMKaoMzPegiu083yPAaQZxRcSov3Rkee0SNyQjutzjKQ:y3bKmlXzGgiuByPA/ee0xj |
| TLSH | T11E74F10BB6D744A5D918DB3BCEF7BB641B44CBB2F19BE35B380A15A914073A5AD000F6 |
| TrID | 71.1% (.EXE) Generic CIL Executable (.NET, Mono, etc.) (73123/4/13) 10.2% (.EXE) Win64 Executable (generic) (10523/12/4) 6.3% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2) 4.3% (.EXE) Win32 Executable (generic) (4505/5/1) 2.0% (.ICL) Windows Icons Library (generic) (2059/9) |
| Reporter |  abuse_ch |
| Tags: | AZORult exe |
Intelligence
File Origin
# of uploads :
1
# of downloads :
370
Origin country :
NLVendor Threat Intelligence
Malware family:
redline
ID:
1
File name:
4363463463464363463463463.bin
Verdict:
Malicious activity
Analysis date:
2023-12-22 21:03:07 UTC
Tags:
hausbomber stealer redline loader amadey botnet lumma arechclient2 backdoor phorpiex trojan stealc rhadamanthys azorult opendir autoit gcleaner risepro lokibot evasion socks5systemz proxy quasar metastealer gh0stcringe gh0st remote rat nanocore metasploit parallax xworm
Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
Azorult
Verdict:
Malicious
Threat level:
10/10
Confidence:
100%
Tags:
azorult packed
Verdict:
Malicious
Labled as:
Trojan.Mardom.MN.Generic
Malware family:
AZORult
Verdict:
Malicious
Result
Threat name:
Azorult, PureLog Stealer
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Signature
.NET source code contains potential unpacker
Antivirus / Scanner detection for submitted sample
Antivirus detection for URL or domain
C2 URLs / IPs found in malware configuration
Found malware configuration
Found many strings related to Crypto-Wallets (likely being stolen)
Injects a PE file into a foreign processes
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for domain / URL
Multi AV Scanner detection for submitted file
Self deletion via cmd or bat file
Snort IDS alert for network traffic
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Yara detected Azorult
Yara detected Azorult Info Stealer
Yara detected Costura Assembly Loader
Yara detected PureLog Stealer
Behaviour
Behavior Graph:
Score:
100%
Verdict:
Malware
File Type:
PE
Detection:
azorult
Threat name:
ByteCode-MSIL.Trojan.PheonixStealer
Status:
Malicious
First seen:
2023-12-18 19:42:55 UTC
File Type:
PE (.Net Exe)
Extracted files:
3
AV detection:
26 of 37 (70.27%)
Threat level:
5/5
Detection(s):
Suspicious file
Verdict:
malicious
Label(s):
azorult
Result
Malware family:
azorult
Score:
10/10
Tags:
family:azorult discovery infostealer trojan
Behaviour
Checks processor information in registry
Delays execution with timeout.exe
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Suspicious use of SetThreadContext
Checks installed software on the system
Checks computer location settings
Deletes itself
Loads dropped DLL
Azorult
Malware Config
C2 Extraction:
http://195.245.112.115/index.php
Unpacked files
SH256 hash:
e6d52c8ff116ce48e1a40eb204e02a4af601fa0ad572bb300877aa50bb205594
MD5 hash:
a727dc13b9df549d7b2456e1bb2df28b
SHA1 hash:
e965b8eff76fab77447f8fdc47343e9f9feecb5f
SH256 hash:
e3063f1faf27edfa674b06816b27aa73eccd3629b249529587a3af7cd7976038
MD5 hash:
098e7d02de27ec7acbf3e28655aecd0b
SHA1 hash:
a1e88bbb23faa3b265bdfbfa8ea84d85000eaf03
Detections:
Azorult
win_azorult_auto
win_azorult_g1
Azorult
SH256 hash:
df9328641977be9723de2515ae1e4cfd1c740547c4c3481ed7e7fa459a00be30
MD5 hash:
32035779344aa5f9eca78e48044961ac
SHA1 hash:
75741e6dc3d4bda711efcc321a0e363a12477226
SH256 hash:
d2a473914c5c33dde3def70744ffb63b392f0fb9d943a6e47e258e8a8346d28c
MD5 hash:
9eb02d4a0fa8e99694d6ad2285906ec3
SHA1 hash:
6c55327026b3fa972c228dc2a6a5acf43c1d3976
SH256 hash:
cdb4f82771d838d1641a0749e9726ad77edcc91b7d34162da03f36a3d201df43
MD5 hash:
b43c38b648f6f242c023d744a3d4aced
SHA1 hash:
c6044466c0f859645482f2565fad4854d0fbf586
Detections:
Typical_Malware_String_Transforms
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
File information
The table below shows additional information about this malware sample such as delivery method and external references.
Comments
Login required
You need to login to in order to write a comment. Login with your abuse.ch account.