MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 d803bbeca71dfcbc03c2e8fed4dbb5c7ccdd778c70558ca282df97dea20fc1bf. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

AZORult

Vendor detections: 17

Intelligence 17 IOCs YARA 9 File information Comments

SHA256 hash:	d803bbeca71dfcbc03c2e8fed4dbb5c7ccdd778c70558ca282df97dea20fc1bf
SHA3-384 hash:	3620d3bb10c8d1d9f6f4f3bb75ffcc00128280da655efd582d6f9fa8968405500ea65cf4c5e374958bf9b6416755f54b
SHA1 hash:	74503a74d7a2b82a4390b092e6c4b66656c6f2ea
MD5 hash:	51034ad4a20dec916ce9a900a667be57
humanhash:	lamp-oxygen-triple-sink
File name:	51034ad4a20dec916ce9a900a667be57.exe
Download:	download sample
Signature	AZORult Create hunting rule
File size:	430'946 bytes
First seen:	2024-03-12 04:45:28 UTC
Last seen:	Never
File type:	exe
MIME type:	application/x-dosexec
imphash	676f4bc1db7fb9f072b157186a10179e (1'400 x AveMariaRAT, 37 x Riskware.Generic, 2 x njrat)
ssdeep	6144:KSTz3MaMNhXbyuWt2EHOO+7qeA5fphPFrKz1K59uYtuwI9JXhr5464NYCmkG0PRy:3Ty7A9ugI9fFCmAPRdhe
TLSH	T135944B8BED44DBBAC26E86B6D56F075E835243326E0B3647A33D90917913B4323B634D
TrID	43.3% (.EXE) Win32 Executable MS Visual C++ (generic) (31206/45/13) 22.9% (.EXE) Microsoft Visual C++ compiled executable (generic) (16529/12/5) 9.1% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2) 7.0% (.EXE) Win16 NE executable (generic) (5038/12/1) 6.2% (.EXE) Win32 Executable (generic) (4504/4/1)
Reporter	abuse_ch
Tags:	AZORult exe

abuse_ch

AZORult C2:
http://xcelonline.000webhostapp.com/index.php

Intelligence

File Origin

# of uploads :

# of downloads :

582

Origin country :

Vendor Threat Intelligence

Malware family:

azorult

ID:

File name:

d803bbeca71dfcbc03c2e8fed4dbb5c7ccdd778c70558ca282df97dea20fc1bf.exe

Verdict:

Malicious activity

Analysis date:

2024-03-12 04:48:57 UTC

Tags:

stealer azorult

Link:

https://app.any.run/tasks/28a21923-e2af-43bd-b6dd-2fe386f63e30

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

Detection:

Azorult

Link:

https://www.capesandbox.com/analysis/478693/

Detection(s):

PUA.Win.Packer.Ep-7

PUA.Win.Packer.Embedpe-3

PUA.Win.Packer.AcprotectUltraprotect-1

Win.Trojan.Ulise-9792178-0

Win.Packed.Skeeeyah-9981222-0

Result

Verdict:

Malware

Maliciousness:

Behaviour

Unauthorized injection to a recently created process

Restart of the analyzed sample

Сreating synchronization primitives

Connection attempt to an infection source

Sending an HTTP POST request to an infection source

Searching for synchronization primitives

Launching the default Windows debugger (dwwin.exe)

Searching for the window

Query of malicious DNS domain

Verdict:

Malicious

Threat level:

10/10

Confidence:

100%

Tags:

nymaim overlay packed packed poison ransomware

Link:

https://www.filescan.io/uploads/65efde0bc1137bbf14984b94/reports/092c914c-b331-459f-8121-a39ac6abc759/overview

Verdict:

Malicious

Labled as:

Win/malicious_confidence_100%

Link:

https://www.hybrid-analysis.com/sample/d803bbeca71dfcbc03c2e8fed4dbb5c7ccdd778c70558ca282df97dea20fc1bf

Malware family:

AZORult

Verdict:

Malicious

Link:

https://analyze.intezer.com/analyses/6223773c-6fef-41c4-aee6-d75d215b7b26

Result

Threat name:

AZORult

Detection:

malicious

Classification:

spyw.evad

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/1407211

Signature

Antivirus / Scanner detection for submitted sample

Contain functionality to detect virtual machines

Contains functionality to inject code into remote processes

Detected AZORult Info Stealer

Detected unpacking (changes PE section rights)

Found many strings related to Crypto-Wallets (likely being stolen)

Injects a PE file into a foreign processes

Machine Learning detection for sample

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Tries to detect sandboxes / dynamic malware analysis system (file name check)

Yara detected Azorult

Yara detected Azorult Info Stealer

Behaviour

Behavior Graph:

Download SVG

Score:

100%

Verdict:

Malware

File Type:

Link:

https://malprob.io/report/d803bbeca71dfcbc03c2e8fed4dbb5c7ccdd778c70558ca282df97dea20fc1bf

Detection:

azorult

Link:

https://mwdb.cert.pl/sample/d803bbeca71dfcbc03c2e8fed4dbb5c7ccdd778c70558ca282df97dea20fc1bf/

Threat name:

Win32.Trojan.Skeeeyah

Status:

Malicious

First seen:

2021-07-18 02:12:58 UTC

File Type:

PE (Exe)

Extracted files:

AV detection:

23 of 24 (95.83%)

Threat level:

5/5

Detection(s):

Malicious file

Link:

https://check.spamhaus.org/check/?searchterm=3ab3x3fhdx6lya6c5d7njw5vy7gn254mobkyziuc36l55iqpyg7q._file

Result

Malware family:

azorult

Score:

10/10

Tags:

family:azorult infostealer trojan

Link:

https://tria.ge/reports/240312-fdy1psaf69/

Behaviour

Suspicious behavior: EnumeratesProcesses

Suspicious use of SetWindowsHookEx

Suspicious use of WriteProcessMemory

Program crash

Suspicious use of SetThreadContext

Azorult

Malware Config

C2 Extraction:

http://xcelonline.000webhostapp.com/index.php

Unpacked files

SH256 hash:

6d9fee542af0fe7ba07f82387256c170e2ae54ebf5ed6f40a7c2851733287aa7

MD5 hash:

3912e62d34954fe255646ce61c4fbfec

SHA1 hash:

75e9786c85172934ead0138c7fdf20671014b403

Link:

https://www.unpac.me/results/14632c29-e800-4e19-941f-54e03d4a0f73/

SH256 hash:

9df228bf50b6de0512a93a0ce8d5472d890ecc56260c432f118a568efa0c8e42

MD5 hash:

2cfb281661e3437dd45de363b5404f54

SHA1 hash:

01cc84f8a9d2a6e6a80b367843668ed8cc7c087c

Detections:

win_azorult_auto

win_azorult_g1

Link:

https://www.unpac.me/results/14632c29-e800-4e19-941f-54e03d4a0f73/

SH256 hash:

d803bbeca71dfcbc03c2e8fed4dbb5c7ccdd778c70558ca282df97dea20fc1bf

MD5 hash:

51034ad4a20dec916ce9a900a667be57

SHA1 hash:

74503a74d7a2b82a4390b092e6c4b66656c6f2ea

Link:

https://www.unpac.me/results/14632c29-e800-4e19-941f-54e03d4a0f73/

Malware family:

AZORult

Verdict:

Malicious

Link:

https://www.vmray.com/analyses/_mb/d803bbeca71d/report/overview.html

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/d803bbeca71dfcbc03c2e8fed4dbb5c7ccdd778c70558ca282df97dea20fc1bf

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	Azorult Create hunting rule
Author:	kevoreilly
Description:	Azorult Payload

Rule name:	BobSoftMiniDelphiBoBBobSoft Create hunting rule
Author:	malware-lu

Rule name:	Borland Create hunting rule
Author:	malware-lu

Rule name:	maldoc_find_kernel32_base_method_1 Create hunting rule
Author:	Didier Stevens (https://DidierStevens.com)

Rule name:	meth_stackstrings Create hunting rule
Author:	Willi Ballenthin

Rule name:	shellcode Create hunting rule
Author:	nex
Description:	Matched shellcode byte patterns

Rule name:	ThreadControl__Context Create hunting rule
Reference:	https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara

Rule name:	Trojan_W32_Gh0stMiancha_1_0_0 Create hunting rule

Rule name:	Windows_Trojan_Azorult_38fce9ea Create hunting rule
Author:	Elastic Security

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape

https://www.capesandbox.com/analysis/478693/

BLint

The following table provides more information about this file using BLint. BLint is a Binary Linter to check the security properties, and capabilities in executables.

Findings

ID	Title	Severity
CHECK_AUTHENTICODE	Missing Authenticode	high
CHECK_NX	Missing Non-Executable Memory Protection	critical
CHECK_PIE	Missing Position-Independent Executable (PIE) Protection	high

Reviews

ID	Capabilities	Evidence
WIN32_PROCESS_API	Can Create Process and Threads	KERNEL32.DLL::CreateProcessW KERNEL32.DLL::VirtualAllocEx KERNEL32.DLL::WriteProcessMemory
WIN_BASE_API	Uses Win Base API	KERNEL32.DLL::LoadLibraryA KERNEL32.DLL::GetStartupInfoA

Comments

Login required

You need to login to in order to write a comment. Login with your abuse.ch account.

No comments found for this malware sample