MALICIOUS — 32ca0c22fcb56a4c4209056275bb31cb5a63dc47c90390f868599dab150239c4

MALICIOUS — 32ca0c22fcb56a4c4209056275bb31cb5a63dc47c90390f868599dab150239c4 is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (95/100), attributed to the Azorult family. 7 of 26 detection engines flagged it, exhibiting 1 ATT&CK technique.

Identification

SHA-256: 32ca0c22fcb56a4c4209056275bb31cb5a63dc47c90390f868599dab150239c4
SHA-1: 71e6bef8f58c72dd11f79c4d999d80c8c36ecc73
MD5: 6a89f354ffd41e4cf774f1fd4465249c
imphash: 59ee824971f432b778ca9bd24dd5ed5f
ssdeep: 6144:1dkVMaJmIG53JVrN/PFXlOx5kYylbJGOVmDN:1iGaJzGLVJ3plOx5kYUJGOwD
TLSH: T1576C5AB7F0A97C91CA60F9901167E50E7C3790848777BF9252A5D46F383920B78C1E8A
Submitted as: 32ca0c22fcb56a4c4209056275bb31cb5a63dc47c90390f868599dab150239c4
File type: pe · Size: 11510272 bytes
Verdict: malicious (95/100) · Family: Azorult

Detections (7 of 26 engines)

MalwareAnalyser heuristics (entropy/packer): Microsoft Linker
YARA: Yara-Rules community: YR_AntiDebug_Checks
Detect It Easy (packer/type): DIE:Microsoft Linker
Microsoft Defender: Trojan:Win32/Azorult.RW!MTB
Emsisoft (Emergency Kit): Gen:Variant.Ransom.Loki.21133
Kaspersky (KVRT): HEUR:Backdoor.Win32.Tofsee.gen
Trellix Stinger (McAfee): Packed-GDT!6A89F354FFD4

MITRE ATT&CK

T1112

Why this verdict

The malicious score of 95/100 is the fusion of 9 weighted signals:

Microsoft Defender flagged Trojan:Win32/Azorult.RW!MTB (rule Trojan:Win32/Azorult.RW!MTB) - engine signal, weight 0.55, confidence 0.85
Emsisoft (Emergency Kit) flagged Gen:Variant.Ransom.Loki.21133 (rule Gen:Variant.Ransom.Loki.21133) - engine signal, weight 0.55, confidence 0.85
Contacted 24 external host(s) at runtime (2 HTTP) - network signal, weight 0.40, confidence 0.80
Extracted Tofsee config (0 C2) - engine signal, weight 0.45, confidence 0.60
YARA: Yara-Rules community flagged YR_AntiDebug_Checks (rule YR_AntiDebug_Checks) - engine signal, weight 0.35, confidence 0.70
Detect It Easy (packer/type) flagged DIE:Microsoft Linker (rule DIE:Microsoft Linker) - engine signal, weight 0.35, confidence 0.70
Embedded network infrastructure: 55.9.42.91, 2.11.50.41 - static signal, weight 0.35, confidence 0.60
Packing/obfuscation: Microsoft Linker - static signal, weight 0.25, confidence 0.55
Observed at runtime: Modify Registry (T1112) (rule Modify Registry) - dynamic signal, weight 0.12, confidence 0.90

Dynamic analysis (windows)

15 behavior events · 1 ATT&CK techniques · 3 dropped files.

Dropped files

ecac1f774712981d8976fd6d43c1f2f74dc8d6414d79116bc0e0dcae73e94ea9 - ecac1f774712981d8976fd6d43c1f2f74dc8d6414d79116bc0e0dcae73e94ea9
448e8aeb2dcd412f100bd4271b6bc0f87d6922877f96d874d74144ec811de88c - 448e8aeb2dcd412f100bd4271b6bc0f87d6922877f96d874d74144ec811de88c
eebe7ab7d427eea6714656ce50ad41314e28170f6f03ab55cae484062256d382 - eebe7ab7d427eea6714656ce50ad41314e28170f6f03ab55cae484062256d382

Embedded URLs

http://www.msftconnecttest.com/connecttest.txt

Embedded domains

inference.location.live.net

Embedded IP addresses

55.9.42.91
2.11.50.41
23.221.133.185
23.40.52.85
20.42.72.131
52.110.12.25
172.215.188.225
20.42.73.24
52.110.12.19
20.247.185.124
52.123.252.203
4.230.171.124
74.178.76.44
40.84.97.4
72.147.149.16
20.42.65.90
52.123.252.197
135.234.160.244
23.33.238.117
20.190.167.148
23.33.238.171
52.110.12.50
172.192.176.118
23.33.238.178
23.198.40.44

File paths

f:\dd\vctools\crt_bld\self_x86\crt\src\mbctype.c
f:\dd\vctools\crt_bld\self_x86\crt\src\tidtable.c
f:\dd\vctools\crt_bld\self_x86\crt\src\stdenvp.c
f:\dd\vctools\crt_bld\self_x86\crt\src\stdargv.c
f:\dd\vctools\crt_bld\self_x86\crt\src\w_env.c
f:\dd\vctools\crt_bld\self_x86\crt\src\ioinit.c
f:\dd\vctools\crt_bld\self_x86\crt\src\onexit.c
f:\dd\vctools\crt_bld\self_x86\crt\src\mlock.c
f:\dd\vctools\crt_bld\self_x86\crt\src\output.c
f:\dd\vctools\crt_bld\self_x86\crt\src\_getbuf.c
f:\dd\vctools\crt_bld\self_x86\crt\src\_file.c
C:\safa.pdb
W:\:
f:\dd\vctools\crt_bld\self_x86\crt\src\wctomb.c
f:\dd\vctools\crt_bld\self_x86\crt\src\atof.c
f:\dd\vctools\crt_bld\self_x86\crt\src\winsig.c
f:\dd\vctools\crt_bld\self_x86\crt\src\crt0msg.c
f:\dd\vctools\crt_bld\self_x86\crt\src\dbgrpt.c
f:\dd\vctools\crt_bld\self_x86\crt\src\localref.c
f:\dd\vctools\crt_bld\self_x86\crt\src\strtoq.c
f:\dd\vctools\crt_bld\self_x86\crt\src\isctype.c
f:\dd\vctools\crt_bld\self_x86\crt\prebuild\include\strgtold12.inl
f:\dd\vctools\crt_bld\self_x86\crt\src\dbgheap.c
f:\dd\vctools\crt_bld\self_x86\crt\src\errmode.c
f:\dd\vctools\crt_bld\self_x86\crt\src\tcscat_s.inl

More Azorult samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report