MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 e9608855df921a6bd122e4060cab126a0bd206b67e9c12618f3d74f5d3328bed. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AZORult


Vendor detections: 8


Intelligence 8 IOCs YARA 3 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: e9608855df921a6bd122e4060cab126a0bd206b67e9c12618f3d74f5d3328bed
SHA3-384 hash: 41babf4fd69b83c48c0529fe54a19fe78c67cc157350c42ece1161c11dc86535b2530c42309180efd8cdd1f9b13b44d7
SHA1 hash: 5a27e72a2844ae0b3355644c9f167233d4aa6480
MD5 hash: 790238f14a53368abaf6a1013e75b652
humanhash: item-solar-wisconsin-purple
File name:ojacry.exe
Download: download sample
Signature AZORult
Create hunting rule
File size:69'632 bytes
First seen:2020-11-03 14:38:07 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash 02ce88f1614faf85fa8c751499e27f4f (2 x AZORult, 1 x GuLoader)
ssdeep 768:yN9YGLwihJ3/ty2X6YIdiSdgy7AESZ/HYH00ZUpMAw6u8e7U:+YMHvlXNA6y4Z/HYH00Z/zG3
Threatray 3'399 similar samples on MalwareBazaar
TLSH 1E632A03FC4C96D3E05442B87D538EB91A526DECA98266AB24112EFB7F743430D5973E
Reporter James_inthe_box
Tags:AZORult exe

Intelligence

File Origin
# of uploads :
1
# of downloads :
126
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/82085/
Detection(s):
Win.Dropper.Azorult-9786632-0
Create hunting rule

Result
Verdict:
Suspicious
Maliciousness:

Behaviour
Sending a UDP request
Creating a window
Unauthorized injection to a recently created process
DNS request
Sending a custom TCP request
Creating a file
Deleting a recently created file
Connection attempt
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Result
Threat name:
Azorult GuLoader Lokibot
Create hunting rule
Detection:
malicious
Classification:
phis.troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/519300
Signature
Binary contains a suspicious time stamp
Contains functionality to detect hardware virtualization (CPUID execution measurement)
Contains functionality to hide a thread from the debugger
Found many strings related to Crypto-Wallets (likely being stolen)
Hides threads from debuggers
Machine Learning detection for sample
Multi AV Scanner detection for domain / URL
Multi AV Scanner detection for submitted file
Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)
Tries to detect Any.run
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Tries to detect virtualization through RDTSC time measurements
Tries to harvest and steal browser information (history, passwords, etc)
Tries to harvest and steal ftp login credentials
Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)
Tries to steal Instant Messenger accounts or passwords
Tries to steal Mail credentials (via file access)
Yara detected Azorult
Yara detected GuLoader
Yara detected Lokibot
Yara detected VB6 Downloader Generic
Behaviour
Behavior Graph:
Download SVG
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/e9608855df921a6bd122e4060cab126a0bd206b67e9c12618f3d74f5d3328bed/
Threat name:
Win32.Infostealer.Azorult
Create hunting rule
Status:
Malicious
First seen:
2020-11-03 09:44:34 UTC
File Type:
PE (Exe)
Extracted files:
4
AV detection:
27 of 29 (93.10%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=5fqiqvo7singxujc4qdazkysnif5ebvwp2obeymphv2pluzsrpwq._file
Verdict:
malicious
Label(s):
azorult
Create hunting rule
Similar samples:
07a7c9a2e1cfa993138d4e7dd1d2cbe608a99b9d701a156182c0ed20dafbffa7
AZORult
39097a208fc44653546ca6f01bd6af471c01b045da19c6f54cdf97d03cfc6c77
AZORult
3a42368f21cb7bf4d9dc5c89e953799bc7bb26e5bb5a21822885fc58bece28c5
AZORult
44b9088e8bd1c22c10d5ea77951a3dda0884a8564187a8f98a4472120f374c91
AZORult
60e4a90b0d8ac89efe92c67bdabc39b364459d7440bd435ad653d667dc57d0ad
AZORult
8ae9a72b45764de26190fe3367f958027e1e0d67a87637ab733fe743a6434667
AZORult
93929bd2d140ca638594136ff62a34082c293ccd527a31b6fc34e1d2c1530f6f
AZORult
9ffc0cc7f5b6bfb1e02d404b6d850e2fd72a778a1a2582fc061723f084cc73c2
AZORult
ac4035cfb9c8a93c294fe1911bd4cd94ce403d8cdc301fa4bf113144b40d1245
AZORult
e9bcebb30731ce1c7ecca26eb2d6a717caf06824fd834775e571d4f684f9d279
AZORult
+ 3'389 additional samples on MalwareBazaar
Result
Malware family:
azorult
Create hunting rule
Score:
  10/10
Tags:
family:azorult discovery infostealer spyware trojan
Link:
https://tria.ge/reports/201103-mzycnfphf6/
Behaviour
Checks processor information in registry
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: MapViewOfSection
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
Suspicious use of NtSetInformationThreadHideFromDebugger
Suspicious use of SetThreadContext
Checks installed software on the system
JavaScript code in executable
Loads dropped DLL
Reads data files stored by FTP clients
Reads user/profile data of local email clients
Reads user/profile data of web browsers
Azorult
Unpacked files
SH256 hash:
49b04162c412105ab0857de16713724cbf3234a0b6ba51f3a5286312633f20c3
MD5 hash:
1f1b425190b2fb0396ad2d538b1060ba
SHA1 hash:
413f98641d46fdcabfcaf64f29495667de6282ea
Link:
https://www.unpac.me/results/4aa42873-c1e8-4f67-8e1e-005435fefac5/
SH256 hash:
e9608855df921a6bd122e4060cab126a0bd206b67e9c12618f3d74f5d3328bed
MD5 hash:
790238f14a53368abaf6a1013e75b652
SHA1 hash:
5a27e72a2844ae0b3355644c9f167233d4aa6480
Link:
https://www.unpac.me/results/4aa42873-c1e8-4f67-8e1e-005435fefac5/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.26
Link:
https://yomi.yoroi.company/submissions/e9608855df921a6bd122e4060cab126a0bd206b67e9c12618f3d74f5d3328bed

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:Azorult
Create hunting rule
Author:JPCERT/CC Incident Response Group
Description:detect Azorult in memory
Reference:internal research
Rule name:Steam_stealer_bin_mem
Create hunting rule
Author:James_inthe_box
Description:Steam in files like avemaria
Rule name:Telegram_stealer_bin_mem
Create hunting rule
Author:James_inthe_box
Description:Telegram in files like avemaria

File information

The table below shows additional information about this malware sample such as delivery method and external references.

  
Delivery method
Other
Cape
Cape
https://www.capesandbox.com/analysis/82085/

Comments