MalwareBazaar Database
You are currently viewing the MalwareBazaar entry for SHA256 e9cfb6eb3a77cd6ea162cf4cb131b5f6ad2a679c0ba9757d718c2f9265a9668f. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.
Database Entry
AZORult
Vendor detections: 19
| SHA256 hash: | e9cfb6eb3a77cd6ea162cf4cb131b5f6ad2a679c0ba9757d718c2f9265a9668f |
|---|---|
| SHA3-384 hash: | 42200ab5fb66e863672030924a7910de399272165df69ab5f83cffe4828deec0f4d8299f2418e1566ad9cad2a24473ca |
| SHA1 hash: | ed7f6d70968fed5cf59ed2a141fca928e1b0522f |
| MD5 hash: | 1c234a8879840da21f197b2608a164c9 |
| humanhash: | muppet-march-summer-ink |
| File name: | 5a765351046fea1490d20f25.exe |
| Download: | download sample |
| Signature | AZORult |
| File size: | 386'048 bytes |
| First seen: | 2024-07-24 14:44:34 UTC |
| Last seen: | Never |
| File type: |  exe |
| MIME type: | application/x-dosexec |
| imphash | f34d5f2d4577ed6d9ceec516c1f5a744 (49'234 x AgentTesla, 20'488 x Formbook, 12'372 x SnakeKeylogger) |
| ssdeep | 6144:IHDNS5okyd+3xOFd0RM9910Qo50yuuJGmdmESvhI3BoUw0h8vIkUm4ggfsJWr:gS5bA+3xOFOG9P6buG7m5gRwJXU/ |
| TLSH | T11384235C3362729CD0F6FAB067511462BB8092AD4B68C5C6CA5B533E5E2D2D7EA010FF |
| TrID | 35.4% (.EXE) Win64 Executable (generic) (10523/12/4) 22.1% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2) 15.1% (.EXE) Win32 Executable (generic) (4504/4/1) 6.9% (.ICL) Windows Icons Library (generic) (2059/9) 6.8% (.EXE) OS/2 Executable (generic) (2029/13) |
| dhash icon | d8c8ccccdcea7e9c (1 x Worm.Virut, 1 x AZORult) |
| Reporter | Anonymous |
| Tags: | AZORult exe |
Anonymous
this malware sample is very nasty!Intelligence
File Origin
# of uploads :
1
# of downloads :
370
Origin country :
FRVendor Threat Intelligence
Malware family:
upatre
ID:
1
File name:
mtk.exe
Verdict:
Malicious activity
Analysis date:
2023-10-24 20:15:04 UTC
Tags:
upatre trojan evasion sinkhole amadey botnet stealer ransomware teslacrypt cerber apt strongpity plugx fareit pony
Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Verdict:
Malicious
Score:
96.5%
Tags:
Execution Network Stealth Heur
Result
Verdict:
Malware
Maliciousness:
Behaviour
Searching for the window
Сreating synchronization primitives
Unauthorized injection to a recently created process
Restart of the analyzed sample
Creating a file
DNS request
Running batch commands
Creating a process with a hidden window
Launching a process
Verdict:
Malicious
Threat level:
10/10
Confidence:
100%
Tags:
confuser confuserex net packed packed vbnet
Verdict:
Malicious
Labled as:
Trojan.Generic
Malware family:
KeyBase
Verdict:
Malicious
Result
Threat name:
n/a
Detection:
malicious
Classification:
evad
Score:
88 / 100
Signature
.NET source code references suspicious native API functions
AI detected suspicious sample
Antivirus / Scanner detection for submitted sample
Injects a PE file into a foreign processes
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for submitted file
Self deletion via cmd or bat file
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Behaviour
Behavior Graph:
Score:
100%
Verdict:
Malware
File Type:
PE
Detection:
azorult
Threat name:
ByteCode-MSIL.Trojan.Generic
Status:
Suspicious
First seen:
2018-02-04 14:50:50 UTC
File Type:
PE (.Net Exe)
Extracted files:
31
AV detection:
27 of 38 (71.05%)
Threat level:
5/5
Detection(s):
Suspicious file
Verdict:
malicious
Label(s):
azorult
Result
Malware family:
azorult
Score:
10/10
Tags:
family:azorult discovery infostealer trojan upx
Behaviour
Delays execution with timeout.exe
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
System Location Discovery: System Language Discovery
Suspicious use of SetThreadContext
Checks computer location settings
Deletes itself
UPX packed file
Azorult
Malware Config
C2 Extraction:
http://benchadcrd.nl/gate.php
Verdict:
Suspicious
Tags:
n/a
YARA:
n/a
Unpacked files
SH256 hash:
3d0e1da94df2b192fa5895e41ce962af024ed0c85b84c120a4fa5aa44830e73e
MD5 hash:
69b0daeccf01074ed5faaa5f69cc1b6f
SHA1 hash:
becdcb6842f60d2eb670c9af68eac06f84e6d68a
Detections:
Azorult
win_azorult_g1
win_azorult_w0
win_azorult_auto
SH256 hash:
526f565a4c29e69525e162ac675e9c794277ccee8fc582efdccc4861fdd5aa2c
MD5 hash:
3858d1e9b8002d62cd83a6afe7c90877
SHA1 hash:
d543e05a9809998901b1ca5ea35f23e33949cb0c
SH256 hash:
fd68f9eb93c8469bb54ead8e4639bc5429b4cb03f6d1b46ef59118fa9b5bd6ea
MD5 hash:
91261f580b98b49ceb3d04e9250c27a1
SHA1 hash:
3aa53d682b361156bf15ab3582493d60dc4449c9
SH256 hash:
e9cfb6eb3a77cd6ea162cf4cb131b5f6ad2a679c0ba9757d718c2f9265a9668f
MD5 hash:
1c234a8879840da21f197b2608a164c9
SHA1 hash:
ed7f6d70968fed5cf59ed2a141fca928e1b0522f
Detections:
SUSP_NET_NAME_ConfuserEx
Malware family:
AZORult v2
Verdict:
Malicious
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
YARA Signatures
MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.
| Rule name: | INDICATOR_EXE_Packed_ConfuserEx |
|---|---|
| Author: | ditekSHen |
| Description: | Detects executables packed with ConfuserEx Mod |
| Rule name: | NETexecutableMicrosoft |
|---|---|
| Author: | malware-lu |
| Rule name: | pe_imphash |
|---|
| Rule name: | Skystars_Malware_Imphash |
|---|---|
| Author: | Skystars LightDefender |
| Description: | imphash |
File information
The table below shows additional information about this malware sample such as delivery method and external references.
Malspam
Delivery method
Distributed via e-mail attachment
BLint
The following table provides more information about this file using BLint. BLint is a Binary Linter to check the security properties, and capabilities in executables.
Findings
| ID | Title | Severity |
|---|---|---|
| CHECK_AUTHENTICODE | Missing Authenticode | high |
| CHECK_DLL_CHARACTERISTICS | Missing dll Security Characteristics (HIGH_ENTROPY_VA) | high |
Comments
Login required
You need to login to in order to write a comment. Login with your abuse.ch account.