🤲🏼 NEW | abuse.ch Community Hub! Earn recognition 🏅 for the malware intelligence you share, climb the leaderboards 📈, and connect with like-minded contributors who share your hunting focus 🤝. Ready to unlock your profile? Go to the Community Hub →

MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 fd64e712eac0c7d5fdec9a1f47c1f384a67a181c13e3e98ff40ee122e9ff8347. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AZORult


Vendor detections: 10


Intelligence 10 IOCs YARA 9 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: fd64e712eac0c7d5fdec9a1f47c1f384a67a181c13e3e98ff40ee122e9ff8347
SHA3-384 hash: 47cd2ac8a83c4547144080ba9151d145ca97198f4f76a38d14ccb01d212fd05e4e68312c1240878a11f805d0d634e561
SHA1 hash: 8308433cb92810bcd6f220e7b6083c778e00fe12
MD5 hash: bc0523db21c69a68ba3e7bfc4711f969
humanhash: glucose-ink-foxtrot-venus
File name:SecuriteInfo.com.Trojan.DownLoader46.42360.32059.13219
Download: download sample
Signature AZORult
Create hunting rule
File size:225'752 bytes
First seen:2024-01-18 05:17:19 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash e1ed1b87d365b2ea75670bba09649dc7 (11 x AZORult)
ssdeep 3072:emLd2f5yZBRE34J8Quhn0o2lGPetr2MVzfeSUESPt30+98Z/KU9pGAn2NphPK:f5EOb38QS2/ZCSU/Pe+98ZKU9pG/Np
TLSH T159247E5172D684EAD37B41B10BB07DE2FB7CF96419C1ADABC7DD393B4C1429068228B6
TrID 40.3% (.EXE) Win64 Executable (generic) (10523/12/4)
19.3% (.EXE) Win16 NE executable (generic) (5038/12/1)
17.2% (.EXE) Win32 Executable (generic) (4505/5/1)
7.7% (.EXE) OS/2 Executable (generic) (2029/13)
7.6% (.EXE) Generic Win/DOS Executable (2002/3)
Reporter SecuriteInfoCom
Tags:AZORult exe

Intelligence

File Origin
# of uploads :
1
# of downloads :
375
Origin country :
FR FR
Vendor Threat Intelligence
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/471412/
Detection(s):
SecuriteInfo.com.Trojan.DownLoader46.42360.32059.13219.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Searching for the window
Sending a custom TCP request
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
overlay packed zusy
Link:
https://www.filescan.io/uploads/65a8b49199da41ccd7d705fc/reports/45a86ff2-5431-484e-9b0a-bf7fddf90014/overview
Verdict:
Malicious
Labled as:
Backdoor.Androm
Link:
https://www.hybrid-analysis.com/sample/fd64e712eac0c7d5fdec9a1f47c1f384a67a181c13e3e98ff40ee122e9ff8347
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/55bc8eba-790d-4a8a-be9b-c96a3b078c2f
Result
Threat name:
AZORult++
Create hunting rule
Detection:
malicious
Classification:
bank.evad
Score:
96 / 100
Link:
https://www.joesandbox.com/analysis/1376508
Signature
Antivirus / Scanner detection for submitted sample
Antivirus detection for URL or domain
Contain functionality to detect virtual machines
Contains functionality to compare user and computer (likely to detect sandboxes)
Contains functionality to inject code into remote processes
Detected AZORult++ Trojan
Detected unpacking (creates a PE file in dynamic memory)
Found evasive API chain (may stop execution after checking mutex)
Multi AV Scanner detection for submitted file
Behaviour
Behavior Graph:
Download SVG
Score:
100%
Verdict:
Malware
File Type:
PE
Link:
https://malprob.io/report/fd64e712eac0c7d5fdec9a1f47c1f384a67a181c13e3e98ff40ee122e9ff8347
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/fd64e712eac0c7d5fdec9a1f47c1f384a67a181c13e3e98ff40ee122e9ff8347/
Threat name:
Win32.Trojan.Malgent
Create hunting rule
Status:
Malicious
First seen:
2023-12-23 16:57:55 UTC
File Type:
PE (Exe)
Extracted files:
1
AV detection:
24 of 38 (63.16%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=7vsooexkydd5l7pmtipupqptqsthuga4cpr6td7ub3qsf2p7qndq._file
Verdict:
malicious
Result
Malware family:
n/a
Score:
  1/10
Tags:
n/a
Link:
https://tria.ge/reports/240118-fy99gadchr/
Unpacked files
SH256 hash:
39781d8122cce3a01e70d8569fc13f035c68b50d9973c791c769971d41016b57
MD5 hash:
231de41ddd373b2b82cc9f03d12a0731
SHA1 hash:
067c5c05d3a0ec1a0e31e39f6fa3e377612d853f
Link:
https://www.unpac.me/results/bb9809fb-fe4c-4516-b1cc-ddecc1d9051b/
SH256 hash:
fd64e712eac0c7d5fdec9a1f47c1f384a67a181c13e3e98ff40ee122e9ff8347
MD5 hash:
bc0523db21c69a68ba3e7bfc4711f969
SHA1 hash:
8308433cb92810bcd6f220e7b6083c778e00fe12
Link:
https://www.unpac.me/results/bb9809fb-fe4c-4516-b1cc-ddecc1d9051b/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/fd64e712eac0c7d5fdec9a1f47c1f384a67a181c13e3e98ff40ee122e9ff8347

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:cobalt_strike_tmp01925d3f
Create hunting rule
Author:The DFIR Report
Description:files - file ~tmp01925d3f.exe
Reference:https://thedfirreport.com
Rule name:DebuggerCheck__API
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:DebuggerCheck__QueryInfo
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:maldoc_find_kernel32_base_method_1
Create hunting rule
Author:Didier Stevens (https://DidierStevens.com)
Rule name:MD5_Constants
Create hunting rule
Author:phoul (@phoul)
Description:Look for MD5 constants
Rule name:NET
Create hunting rule
Author:malware-lu
Rule name:PE_Digital_Certificate
Create hunting rule
Author:albertzsigovits
Rule name:SUSP_ENV_Folder_Root_File_Jan23_1
Create hunting rule
Author:Florian Roth (Nextron Systems)
Description:Detects suspicious file path pointing to the root of a folder easily accessible via environment variables
Reference:Internal Research
Rule name:ThreadControl__Context
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/471412/

Comments