MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 d92c973ecc0a47bbb7d56fdec3471e90a88b49406b27b743f3f01433b0163ca8. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AZORult


Vendor detections: 15


Intelligence 15 IOCs 1 YARA 6 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: d92c973ecc0a47bbb7d56fdec3471e90a88b49406b27b743f3f01433b0163ca8
SHA3-384 hash: 7a17ecc2186b5e6763301d490ea74aab22945746456285d821431c19688d7295f3cfd10658a0656b631073f91c0ac8a3
SHA1 hash: 4e75fb1f68ae10b98e432c443d740229c370453f
MD5 hash: c6152a34c16494d6e75c276de8d76827
humanhash: iowa-tango-montana-black
File name:PO CBV87654469.exe
Download: download sample
Signature AZORult
Create hunting rule
File size:438'564 bytes
First seen:2022-09-29 20:31:49 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash 12e12319f1029ec4f8fcbed7e82df162 (390 x DCRat, 52 x RedLineStealer, 51 x Formbook)
ssdeep 6144:uTouKrWBEu3/Z2lpGDHU3ykJFqNbi/PRNU2Pg1++F8lTx4DN/Y8FyT+:uToPWBv/cpGrU3ywumk6g1bZDNw8Fyq
Threatray 1'607 similar samples on MalwareBazaar
TLSH T10C94C002FAC084B2D5A31A321A35AB21693E7D201FB5CEDF63947A6DDE321C1D631767
TrID 89.0% (.EXE) WinRAR Self Extracting archive (4.x-5.x) (265042/9/39)
3.5% (.EXE) Win64 Executable (generic) (10523/12/4)
2.2% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
1.6% (.EXE) Win16 NE executable (generic) (5038/12/1)
1.5% (.EXE) Win32 Executable (generic) (4505/5/1)
File icon (PE):PE icon
dhash icon 050559c9190a4460 (13 x RemcosRAT, 5 x AgentTesla, 3 x Formbook)
Reporter abuse_ch
Tags:AZORult exe


Avatar
abuse_ch
AZORult C2:
http://gw1naz.shop/PL341/index.php

Indicators Of Compromise (IOCs)

Below is a list of indicators of compromise (IOCs) associated with this malware samples.

IOCThreatFox Reference
http://gw1naz.shop/PL341/index.php https://threatfox.abuse.ch/ioc/858554/

Intelligence

File Origin
# of uploads :
1
# of downloads :
414
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/314946/
Detection(s):
SecuriteInfo.com.Trojan.GenericKD.38920448.13962.7593.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
Searching for the window
Сreating synchronization primitives
Searching for synchronization primitives
Creating a file in the %temp% directory
Creating a process from a recently created file
Launching the default Windows debugger (dwwin.exe)
Creating a file
Reading critical registry keys
Running batch commands
Creating a process with a hidden window
Launching a process
Unauthorized injection to a recently created process by context flags manipulation
Query of malicious DNS domain
Stealing user critical data
Sending an HTTP POST request to an infection source
Result
Malware family:
n/a
Score:
  6/10
Tags:
n/a
Link:
https://dragonfly.certego.net/analysis/40061/overview
Behaviour
MalwareBazaar
MeasuringTime
EvasionQueryPerformanceCounter
Verdict:
Suspicious
Threat level:
  5/10
Confidence:
100%
Tags:
anti-vm greyware overlay packed setupapi.dll shdocvw.dll shell32.dll
Link:
https://www.filescan.io/uploads/633600cbd089a0c15dd2cbae/reports/b49235d7-35d6-499e-8cd2-7b0167d584ea/overview
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Verdict:
Suspicious
Link:
https://analyze.intezer.com/analyses/44c43cd1-bb04-4719-99bb-9cf8591ebe9c
Result
Threat name:
Azorult
Create hunting rule
Detection:
malicious
Classification:
phis.troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1080483
Signature
Antivirus detection for dropped file
C2 URLs / IPs found in malware configuration
Found hidden mapped module (file has been removed from disk)
Found many strings related to Crypto-Wallets (likely being stolen)
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
Maps a DLL or memory area into another process
Multi AV Scanner detection for domain / URL
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Snort IDS alert for network traffic
Tries to harvest and steal Bitcoin Wallet information
Tries to harvest and steal browser information (history, passwords, etc)
Tries to harvest and steal ftp login credentials
Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)
Tries to steal Crypto Currency Wallets
Tries to steal Instant Messenger accounts or passwords
Tries to steal Mail credentials (via file / registry access)
Yara detected Azorult
Yara detected Azorult Info Stealer
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 713041 Sample: PO CBV87654469.exe Startdate: 29/09/2022 Architecture: WINDOWS Score: 100 43 Snort IDS alert for network traffic 2->43 45 Multi AV Scanner detection for domain / URL 2->45 47 Malicious sample detected (through community Yara rule) 2->47 49 8 other signatures 2->49 9 PO CBV87654469.exe 10 2->9         started        process3 file4 37 C:\Users\user\AppData\Local\...\xwsddqazr.exe, PE32 9->37 dropped 12 xwsddqazr.exe 1 9->12         started        process5 file6 39 C:\Users\user\AppData\Local\Temp\22C6.tmp, PE32 12->39 dropped 59 Found hidden mapped module (file has been removed from disk) 12->59 61 Maps a DLL or memory area into another process 12->61 16 xwsddqazr.exe 63 12->16         started        21 WerFault.exe 23 9 12->21         started        signatures7 process8 dnsIp9 41 gw1naz.shop 104.21.31.178, 49719, 49723, 80 CLOUDFLARENETUS United States 16->41 29 C:\Users\user\AppData\Local\...\softokn3.dll, PE32 16->29 dropped 31 C:\Users\user\AppData\Local\...\nssdbm3.dll, PE32 16->31 dropped 33 C:\Users\user\AppData\Local\Temp\...\nss3.dll, PE32 16->33 dropped 35 45 other files (2 malicious) 16->35 dropped 51 Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc) 16->51 53 Tries to steal Instant Messenger accounts or passwords 16->53 55 Tries to steal Mail credentials (via file / registry access) 16->55 57 4 other signatures 16->57 23 cmd.exe 1 16->23         started        file10 signatures11 process12 process13 25 conhost.exe 23->25         started        27 timeout.exe 1 23->27         started       
Detection:
azorult
Create hunting rule
Link:
https://mwdb.cert.pl/sample/d92c973ecc0a47bbb7d56fdec3471e90a88b49406b27b743f3f01433b0163ca8/
Threat name:
Win32.Trojan.LokiBot
Create hunting rule
Status:
Malicious
First seen:
2022-09-29 11:18:03 UTC
File Type:
PE (Exe)
Extracted files:
10
AV detection:
21 of 26 (80.77%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=3ewjopwmbjd3xn6vn7pmgry6scuiwskanmt3oq7t6akdhmawhsua._file
Verdict:
malicious
Label(s):
azorult
Create hunting rule
Similar samples:
0c22e8ea0ba6fc4f77bd273a12dd319e991899499b4bea8422d146d447034505
AZORult
1a37f5980dfaccf82f357074e3d3013e6280e14ddb291ff49b539393daa9da6d
AZORult
290b9cd7f795ed30712637f8e6f7779412260c6f7ac70c70615d2e4a92960e0a
AZORult
301a3e665000c99ab655a74dbf9408de24875866528be4f6d28e83490c19305b
AZORult
339539d03ce22693c391b3141e6c20b2403da4efe6e25247c87c81a2e2fe1530
AZORult
390ba9da469491e34db509524293b00feb22b768a11c0792d67c92b17881a521
AZORult
432c99b8f1108ed0d94b7b1e620b230f8f55c47ca62c0fcdd1a3afac8548f239
AZORult
ce349034ea5373d13d5fa3adaf34a3ecffff799fe9044d4a2c98bd8a16f0e9ed
AZORult
f56bd344f2e9650ba6def3340bc5ac26472ea615744b38786d5445a75a0e51b4
AZORult
+ 1'597 additional samples on MalwareBazaar
Result
Malware family:
azorult
Create hunting rule
Score:
  10/10
Tags:
family:azorult collection discovery infostealer spyware stealer trojan
Link:
https://tria.ge/reports/220929-za94cabhf3/
Behaviour
Checks processor information in registry
Delays execution with timeout.exe
Suspicious behavior: EnumeratesProcesses
Suspicious use of WriteProcessMemory
outlook_office_path
outlook_win_path
Enumerates physical storage devices
Program crash
Suspicious use of SetThreadContext
Accesses Microsoft Outlook profiles
Accesses cryptocurrency files/wallets, possible credential harvesting
Checks installed software on the system
Loads dropped DLL
Reads data files stored by FTP clients
Reads local data of messenger clients
Reads user/profile data of local email clients
Reads user/profile data of web browsers
Executes dropped EXE
Azorult
Verdict:
Suspicious
Tags:
n/a
YARA:
n/a
Link:
https://app.threat.zone/submission/14e8463f-f9ff-477a-8933-b92f91ba3c06
Unpacked files
SH256 hash:
b438ded132042bd35ad3063baa5a24130c2f980248985ec54450c644d207cd91
MD5 hash:
b5371db678c70b7b49e43d34a66c02d3
SHA1 hash:
7840ac400d639cf2f0c67f18afa0ff14a48851bd
Detections:
win_azorult_auto
Create hunting rule
win_azorult_g1
Create hunting rule
Link:
https://www.unpac.me/results/c17fc736-73f3-493c-bfd8-03ba279c0457/
Parent samples :
390ba9da469491e34db509524293b00feb22b768a11c0792d67c92b17881a521
d92c973ecc0a47bbb7d56fdec3471e90a88b49406b27b743f3f01433b0163ca8
SH256 hash:
1468706f212bf481f941f9904c95202a1317a8fba10cc5027f9570be5837390b
MD5 hash:
53a9a86e2cfe5269a48ea8b17a3c923b
SHA1 hash:
bfceb57ab4f22a956b76cfbbba0b8f384caee063
Link:
https://www.unpac.me/results/c17fc736-73f3-493c-bfd8-03ba279c0457/
SH256 hash:
d92c973ecc0a47bbb7d56fdec3471e90a88b49406b27b743f3f01433b0163ca8
MD5 hash:
c6152a34c16494d6e75c276de8d76827
SHA1 hash:
4e75fb1f68ae10b98e432c443d740229c370453f
Link:
https://www.unpac.me/results/c17fc736-73f3-493c-bfd8-03ba279c0457/
Malware family:
AZORult v3
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/d92c973ecc0a/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/d92c973ecc0a47bbb7d56fdec3471e90a88b49406b27b743f3f01433b0163ca8

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:Azorult
Create hunting rule
Author:kevoreilly
Description:Azorult Payload
Rule name:malware_Azorult
Create hunting rule
Author:JPCERT/CC Incident Response Group
Description:detect Azorult in memory
Reference:internal research
Rule name:pdb_YARAify
Create hunting rule
Author:@wowabiy314
Description:PDB
Rule name:RansomwareTest8
Create hunting rule
Author:Daoyuan Wu
Description:Test Ransomware YARA rules
Rule name:sfx_pdb
Create hunting rule
Author:@razvialex
Description:Detect interesting files containing sfx with pdb paths.
Rule name:win_azorult_auto
Create hunting rule
Author:Felix Bilstein - yara-signator at cocacoding dot com
Description:Detects win.azorult.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/314946/

Comments