🤲🏼 NEW | abuse.ch Community Hub! Earn recognition 🏅 for the malware intelligence you share, climb the leaderboards 📈, and connect with like-minded contributors who share your hunting focus 🤝. Ready to unlock your profile? Go to the Community Hub →

MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 f7e8e4b2e30621f7ff042c3a42a77ef7e25e75d2c3ad265833198e5b374c24fe. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AZORult


Vendor detections: 10


Intelligence 10 IOCs YARA 2 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: f7e8e4b2e30621f7ff042c3a42a77ef7e25e75d2c3ad265833198e5b374c24fe
SHA3-384 hash: 6e3b6ae0f5d1e1532e62b43c883e247201886f2beede6179b3b9bc5ef331cbcd4bf0850f8338383a83928dd84d431719
SHA1 hash: 94773be10ae633dd40b7b880247c03664719cedf
MD5 hash: a79062799aced4dd8fc1768b926cdcda
humanhash: lion-maine-asparagus-hot
File name:Myrosin.exe
Download: download sample
Signature AZORult
Create hunting rule
File size:1'303'888 bytes
First seen:2023-10-23 14:25:18 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash b34f154ec913d2d2c435cbd644e91687 (592 x GuLoader, 130 x RemcosRAT, 84 x EpsilonStealer)
ssdeep 24576:4+DHq+nW5pgR67xiegibLL9WKgILf+wNE1r1tdRadUfuEYpqpB99fv0Ooc8:LLLW5pZ7kedbLLbb+wNMtzadSudpqTbw
Threatray 443 similar samples on MalwareBazaar
TLSH T1BA5523248D40DE22E6E5163396640FFF15226C0F96496DB7039C7E4C767A182BF2E3DA
TrID 47.3% (.EXE) Win32 Executable MS Visual C++ (generic) (31206/45/13)
15.9% (.EXE) Win64 Executable (generic) (10523/12/4)
9.9% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
7.6% (.EXE) Win16 NE executable (generic) (5038/12/1)
6.8% (.EXE) Win32 Executable (generic) (4505/5/1)
Reporter abuse_ch
Tags:AZORult exe


Avatar
abuse_ch
AZORult C2:
http://m1chs.shop/LB341/index.php

Intelligence

File Origin
# of uploads :
1
# of downloads :
343
Origin country :
NL NL
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
Myrosin.exe
Verdict:
Suspicious activity
Analysis date:
2023-10-23 14:27:33 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/41da05d0-46bf-42ed-9ecc-9d337509b9ce

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection(s):
SecuriteInfo.com.Trojan.NSIS.Agent.1316.6449.UNOFFICIAL
Create hunting rule

Result
Verdict:
Clean
Maliciousness:

Behaviour
Creating a window
Creating a file
Creating a file in the %temp% subdirectories
Creating a file in the Windows subdirectories
Gathering data
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
control installer lolbin overlay packed shell32
Link:
https://www.filescan.io/uploads/6536827b2614136586e9db29/reports/f06dc0af-62b6-49a7-a4b5-1ddcd763354c/overview
Verdict:
Malicious
Labled as:
Win/grayware_confidence_70%
Link:
https://www.hybrid-analysis.com/sample/f7e8e4b2e30621f7ff042c3a42a77ef7e25e75d2c3ad265833198e5b374c24fe
Verdict:
Unknown
Link:
https://analyze.intezer.com/analyses/36a76ace-dc81-4716-a859-5d1c4cb55f79
Result
Threat name:
GuLoader
Create hunting rule
Detection:
malicious
Classification:
troj.evad.phis.spyw
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1330652
Signature
Antivirus detection for URL or domain
Maps a DLL or memory area into another process
Self deletion via cmd or bat file
Snort IDS alert for network traffic
Tries to harvest and steal Bitcoin Wallet information
Tries to harvest and steal browser information (history, passwords, etc)
Tries to harvest and steal ftp login credentials
Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)
Tries to steal Crypto Currency Wallets
Tries to steal Instant Messenger accounts or passwords
Tries to steal Mail credentials (via file / registry access)
Yara detected GuLoader
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1330652 Sample: Myrosin.exe Startdate: 23/10/2023 Architecture: WINDOWS Score: 100 34 m1chs.shop 2->34 36 aiv.mk 2->36 42 Snort IDS alert for network traffic 2->42 44 Antivirus detection for URL or domain 2->44 46 Yara detected GuLoader 2->46 9 Myrosin.exe 49 2->9         started        signatures3 process4 file5 24 C:\Users\user\AppData\Local\...\System.dll, PE32 9->24 dropped 48 Self deletion via cmd or bat file 9->48 50 Maps a DLL or memory area into another process 9->50 13 Myrosin.exe 63 9->13         started        signatures6 process7 dnsIp8 38 m1chs.shop 172.67.213.31, 50040, 50041, 80 CLOUDFLARENETUS United States 13->38 40 aiv.mk 95.156.8.108, 443, 50039 MT-AS-OWNbulOrceNikolovbbMK Macedonia 13->40 26 C:\Users\user\AppData\...\vcruntime140.dll, PE32 13->26 dropped 28 C:\Users\user\AppData\Local\...\ucrtbase.dll, PE32 13->28 dropped 30 C:\Users\user\AppData\Local\...\softokn3.dll, PE32 13->30 dropped 32 45 other files (none is malicious) 13->32 dropped 52 Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc) 13->52 54 Tries to steal Instant Messenger accounts or passwords 13->54 56 Tries to steal Mail credentials (via file / registry access) 13->56 58 5 other signatures 13->58 18 cmd.exe 1 13->18         started        file9 signatures10 process11 process12 20 conhost.exe 18->20         started        22 timeout.exe 1 18->22         started       
Score:
76%
Verdict:
Malware
File Type:
PE
Link:
https://malprob.io/report/f7e8e4b2e30621f7ff042c3a42a77ef7e25e75d2c3ad265833198e5b374c24fe
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/f7e8e4b2e30621f7ff042c3a42a77ef7e25e75d2c3ad265833198e5b374c24fe/
Threat name:
Win32.Trojan.Guloader
Create hunting rule
Status:
Suspicious
First seen:
2023-10-23 14:43:06 UTC
AV detection:
10 of 37 (27.03%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=67uojmxdayq7p7yefq5efj3667rf45osyowsmwbtdghfwn2met7a._file
Verdict:
malicious
Label(s):
cloudeye
Create hunting rule
Similar samples:
1e08bbecaa308b4390f6313410fb0f23c47c989e1a247c21fd0ab26b72f666c6
AZORult
466a8e22e7c7b6f48e4ad215d7366ef595748a37f4ce4a50449ecc89fbe16d2b
AZORult
49a73b28d4122d560e987d24674e9e5e0038aa6c56e83e07b43c383b5b29ff44
AZORult
52b0f189a1e266fd5e8ebbb97d116c47a28842eea388669753657342a9dc4083
AZORult
69b1f9d8334bb44d7b7f10a9efc31ad30cfe72ded8bd3e4a6da67b71a2bd485d
AZORult
69c845dfc6e399c55730f8ffe5a7c822f3b36f94cf5905415d8b673e9f391329
AZORult
ac1f084845ff5e15e2e7748d5ca4ebfc36334b62e02d51d1ddb17c8fcf7bb210
AZORult
b20c6f8b483814a96dcf489365aab049a9b6cf9f165b02c087dad363594fad65
AZORult
+ 433 additional samples on MalwareBazaar
Result
Malware family:
azorult
Create hunting rule
Score:
  10/10
Tags:
family:azorult collection discovery infostealer spyware stealer trojan
Link:
https://tria.ge/reports/231023-rrve8abb33/
Behaviour
Checks processor information in registry
Delays execution with timeout.exe
Modifies system certificate store
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: MapViewOfSection
Suspicious use of WriteProcessMemory
outlook_office_path
outlook_win_path
Enumerates physical storage devices
Program crash
Drops file in Windows directory
Drops file in System32 directory
Suspicious use of NtCreateThreadExHideFromDebugger
Suspicious use of NtSetInformationThreadHideFromDebugger
Suspicious use of SetThreadContext
Accesses Microsoft Outlook profiles
Accesses cryptocurrency files/wallets, possible credential harvesting
Checks installed software on the system
Deletes itself
Loads dropped DLL
Reads data files stored by FTP clients
Reads local data of messenger clients
Reads user/profile data of local email clients
Reads user/profile data of web browsers
Azorult
Unpacked files
SH256 hash:
3eb38ae99653a7dbc724132ee240f6e5c4af4bfe7c01d31d23faf373f9f2eaca
MD5 hash:
0d7ad4f45dc6f5aa87f606d0331c6901
SHA1 hash:
48df0911f0484cbe2a8cdd5362140b63c41ee457
Link:
https://www.unpac.me/results/8aed8aaa-837c-4de0-b3c4-c2103ea5096f/
SH256 hash:
f7e8e4b2e30621f7ff042c3a42a77ef7e25e75d2c3ad265833198e5b374c24fe
MD5 hash:
a79062799aced4dd8fc1768b926cdcda
SHA1 hash:
94773be10ae633dd40b7b880247c03664719cedf
Link:
https://www.unpac.me/results/8aed8aaa-837c-4de0-b3c4-c2103ea5096f/
Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:PE_Digital_Certificate
Create hunting rule
Author:albertzsigovits
Rule name:PE_Potentially_Signed_Digital_Certificate
Create hunting rule
Author:albertzsigovits

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Comments