MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 cf6a0127f90f8d0155b5b822830bbe5f0b1966e74f805b4c1814af34df750748. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AZORult


Vendor detections: 14


Intelligence 14 IOCs YARA 2 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: cf6a0127f90f8d0155b5b822830bbe5f0b1966e74f805b4c1814af34df750748
SHA3-384 hash: 28fac3affbc4b333fec9f66e80a399a9c24ab1c9adcc167b38a1fe576ca2faad2350ce99d99f766f568ea6c40b845b33
SHA1 hash: 6af237c77fe5e9f3f48ab1c4432a0aef0d046c65
MD5 hash: 37b10d88c783c48c404dd39365c47540
humanhash: wolfram-beer-football-king
File name:RFQ-MRF343951.exe
Download: download sample
Signature AZORult
Create hunting rule
File size:618'496 bytes
First seen:2023-05-01 06:10:13 UTC
Last seen:2023-05-13 22:56:37 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'746 x AgentTesla, 19'628 x Formbook, 12'242 x SnakeKeylogger)
ssdeep 12288:h3dpNj8zd+7fDYtzKuCns60yj2+GOkdLpLgqPinVqbOk:Xjj8zd6oh4GzPin8b7
Threatray 1'237 similar samples on MalwareBazaar
TLSH T163D4CF162029CD8AFD1D8B34C474FBF462B9BDB3E4D59123277A7D49F9BAB010D0825A
TrID 63.0% (.EXE) Generic CIL Executable (.NET, Mono, etc.) (73123/4/13)
11.2% (.SCR) Windows screen saver (13097/50/3)
9.0% (.EXE) Win64 Executable (generic) (10523/12/4)
5.6% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
3.8% (.EXE) Win32 Executable (generic) (4505/5/1)
File icon (PE):PE icon
dhash icon c0f43ebeb45012b2 (7 x AgentTesla, 4 x Loki, 2 x Formbook)
Reporter abuse_ch
Tags:AZORult exe


Avatar
abuse_ch
AZORult C2:
http://171.22.30.164/papi/index.php

Intelligence

File Origin
# of uploads :
2
# of downloads :
585
Origin country :
NL NL
Vendor Threat Intelligence
Malware family:
azorult
Create hunting rule
ID:
1
File name:
RFQ-MRF343951.exe
Verdict:
Malicious activity
Analysis date:
2023-05-01 06:11:54 UTC
Tags:
trojan rat azorult stealer
Link:
https://app.any.run/tasks/61224bf0-e0db-443d-b507-01480a22205f

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/385775/
Detection(s):
Sanesecurity.Malware.28872.BadIN4.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Searching for the window
Creating a window
Creating a file in the %temp% directory
Verdict:
Suspicious
Threat level:
  5/10
Confidence:
100%
Tags:
packed
Link:
https://www.filescan.io/uploads/644f57f5edfde86c7981554f/reports/0af0a2b2-90ac-46bd-b9b3-a1ab21c1310e/overview
Verdict:
Malicious
Labled as:
Win/malicious_confidence_90%
Link:
https://www.hybrid-analysis.com/sample/cf6a0127f90f8d0155b5b822830bbe5f0b1966e74f805b4c1814af34df750748
Result
Verdict:
UNKNOWN
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Verdict:
Unknown
Link:
https://analyze.intezer.com/analyses/d337753d-8b43-4781-8654-9b439b2de3e3
Result
Threat name:
Azorult
Create hunting rule
Detection:
malicious
Classification:
phis.troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1223881
Signature
.NET source code contains potential unpacker
Antivirus detection for URL or domain
C2 URLs / IPs found in malware configuration
Found malware configuration
Found many strings related to Crypto-Wallets (likely being stolen)
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for submitted file
Snort IDS alert for network traffic
Tries to harvest and steal Bitcoin Wallet information
Tries to harvest and steal browser information (history, passwords, etc)
Tries to harvest and steal ftp login credentials
Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)
Tries to steal Crypto Currency Wallets
Tries to steal Instant Messenger accounts or passwords
Tries to steal Mail credentials (via file / registry access)
Yara detected Azorult
Yara detected Azorult Info Stealer
Behaviour
Behavior Graph:
Download SVG
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/cf6a0127f90f8d0155b5b822830bbe5f0b1966e74f805b4c1814af34df750748/
Threat name:
ByteCode-MSIL.Spyware.Azorult
Create hunting rule
Status:
Malicious
First seen:
2023-05-01 03:05:42 UTC
File Type:
PE (.Net Exe)
Extracted files:
17
AV detection:
21 of 37 (56.76%)
Threat level:
  2/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=z5vacj7zb6gqcvnvxarigc56l4frszxhj6afwtaycsxtjx3va5ea._file
Verdict:
malicious
Label(s):
azorult
Create hunting rule
Similar samples:
0239bc35516d6d3680c64f7a5a5a40801c7b0ea4db8a80718e4774687c565af3
AZORult
3ea0d5204b7f00592980a76c06e5210758c6ac6cb1bc8e90c03739d0ec8ddf76
AZORult
4a4a4c441355bbf90def9ab2aec89335f93237487e670df04b3d63c65b5be25a
AZORult
69d0885e1490db820cfa69e85ee79f0fa96375c65b32606c3fa2a6edfe19cf1a
AZORult
722ef401e5cbb067c5c33faa402774d3c75ef08e0c8cc4d7e66a9cfa53684088
AZORult
7f24773d411236705d09adba6b9b52a10b8f2f9d1963abb1b243d4eb72bfba9c
AZORult
8a43978a73d92e6cb41e74aae94482dfedec054c4ade4b717b249cfcdcc21844
AZORult
d8c4fb5e1c854c9362c4129efbaa6b72435b8e93df66fd418f288650d360ff22
AZORult
+ 1'227 additional samples on MalwareBazaar
Result
Malware family:
azorult
Create hunting rule
Score:
  10/10
Tags:
family:azorult collection discovery infostealer spyware stealer trojan
Link:
https://tria.ge/reports/230501-gxk4maef46/
Behaviour
Checks processor information in registry
Suspicious behavior: EnumeratesProcesses
Suspicious use of WriteProcessMemory
outlook_office_path
outlook_win_path
Suspicious use of SetThreadContext
Accesses Microsoft Outlook profiles
Accesses cryptocurrency files/wallets, possible credential harvesting
Checks installed software on the system
Loads dropped DLL
Reads data files stored by FTP clients
Reads local data of messenger clients
Reads user/profile data of local email clients
Reads user/profile data of web browsers
Azorult
Malware Config
C2 Extraction:
http://171.22.30.164/papi/index.php
Unpacked files
SH256 hash:
21f0154b51a09767f94922b81f5fcd15cf4a6390ab7314e40d0e17b2dcdfe6ba
MD5 hash:
c926563698de3a89ad20474c85122f73
SHA1 hash:
ed1a3b2527ace111e6f39880c7ee3965f301330d
Link:
https://www.unpac.me/results/d683f6c4-cd76-4ff2-8d29-27ddd649b623/
SH256 hash:
2f11859da7188eb4f95635e37ca76bae6b21c0b81cda2d36b764b173e8679106
MD5 hash:
156fb9088a971bbae6f139383b5d5607
SHA1 hash:
dc897d0295a720c3ca6be53bbf44a581ae8f5444
Link:
https://www.unpac.me/results/d683f6c4-cd76-4ff2-8d29-27ddd649b623/
SH256 hash:
628a2f8c1e1de0843dcc3986972ab7a40824cfb94e0df84ffb4a157c0f666da7
MD5 hash:
ceedb98f544bad66d3b0ff8728c4def2
SHA1 hash:
b98e12e4cce128533a2a9988ee4e83fdc6f2da60
Link:
https://www.unpac.me/results/d683f6c4-cd76-4ff2-8d29-27ddd649b623/
SH256 hash:
210b1eb2345dfe440a2559cf88e8f8b3d09bd17e7fe0bb8b8346fb289e408c9d
MD5 hash:
417f2464afdb5726db3bc846030d37e3
SHA1 hash:
88410011a19de14fe6ac611ee253ec3d903f07a1
Detections:
Azorult
Create hunting rule
win_azorult_auto
Create hunting rule
win_azorult_g1
Create hunting rule
Link:
https://www.unpac.me/results/d683f6c4-cd76-4ff2-8d29-27ddd649b623/
SH256 hash:
cadd0ce24883e098673856b7c05e7ae0cccc41c7f6f3f71b63549164c9200014
MD5 hash:
99aa5d2153b5b80401c489ee9db41aa3
SHA1 hash:
58d937d60db67e81de6c1865cf22a8e8d626e01b
Link:
https://www.unpac.me/results/d683f6c4-cd76-4ff2-8d29-27ddd649b623/
SH256 hash:
cf6a0127f90f8d0155b5b822830bbe5f0b1966e74f805b4c1814af34df750748
MD5 hash:
37b10d88c783c48c404dd39365c47540
SHA1 hash:
6af237c77fe5e9f3f48ab1c4432a0aef0d046c65
Link:
https://www.unpac.me/results/d683f6c4-cd76-4ff2-8d29-27ddd649b623/
Malware family:
AZORult v3
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/cf6a0127f90f/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/cf6a0127f90f8d0155b5b822830bbe5f0b1966e74f805b4c1814af34df750748

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:pe_imphash
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/385775/

Comments