MALICIOUS — 8cd791fc2caaba65e2549fb8b65e481878bcc7557094abb4c568adef1ef5344e

MALICIOUS — 8cd791fc2caaba65e2549fb8b65e481878bcc7557094abb4c568adef1ef5344e is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (97/100), attributed to the Azorult family. 7 of 26 detection engines flagged it, exhibiting 1 ATT&CK technique.

Identification

• SHA-256: 8cd791fc2caaba65e2549fb8b65e481878bcc7557094abb4c568adef1ef5344e
• SHA-1: bcdb0b446f703357546ab83d455c323303d3e129
• MD5: 3afcd25b5bfb5e3f892a657792e1f16a
• imphash: e024db68009cf7f32dd817cae1867bf3
• ssdeep: 6144:bek1A1rRyHUhypK7+U5KyvBxxCYgVfFcYuTmxJr:b1iyhE+YxvBxxCYeFcYuSx
• TLSH: T1696F7D325E6A387AC825B91156AF908D3C31F0BE477B7F4062C1965F393198733D829A
• Submitted as: 8cd791fc2caaba65e2549fb8b65e481878bcc7557094abb4c568adef1ef5344e
• File type: pe · Size: 15123968 bytes
• Verdict: malicious (97/100) · Family: Azorult

Detections (7 of 26 engines)

• MalwareAnalyser heuristics (entropy/packer): Microsoft Linker
• YARA: Yara-Rules community: YR_AntiDebug_Checks
• Detect It Easy (packer/type): DIE:Microsoft Linker
• Microsoft Defender: Trojan:Win32/Azorult.RW!MTB
• Emsisoft (Emergency Kit): Trojan.Crypt
• Kaspersky (KVRT): HEUR:Backdoor.Win32.Tofsee.gen
• Trellix Stinger (McAfee): Packed-GDT!3AFCD25B5BFB

MITRE ATT&CK

• T1112

Why this verdict

The malicious score of 97/100 is the fusion of 10 weighted signals:

• Microsoft Defender flagged Trojan:Win32/Azorult.RW!MTB (rule Trojan:Win32/Azorult.RW!MTB) - engine signal, weight 0.55, confidence 0.85
• Emsisoft (Emergency Kit) flagged Trojan.Crypt (rule Trojan.Crypt) - engine signal, weight 0.55, confidence 0.85
• Memory forensics: 2 finding(s), e.g. SSDT hook (rule windows.ssdt.SSDT) - memory signal, weight 0.50, confidence 0.85
• Contacted 36 external host(s) at runtime (10 HTTP) - network signal, weight 0.40, confidence 0.80
• Extracted Tofsee config (0 C2) - engine signal, weight 0.45, confidence 0.60
• YARA: Yara-Rules community flagged YR_AntiDebug_Checks (rule YR_AntiDebug_Checks) - engine signal, weight 0.35, confidence 0.70
• Detect It Easy (packer/type) flagged DIE:Microsoft Linker (rule DIE:Microsoft Linker) - engine signal, weight 0.35, confidence 0.70
• Embedded network infrastructure: 55.9.42.91, 2.11.50.41 - static signal, weight 0.35, confidence 0.60
• Packing/obfuscation: Microsoft Linker - static signal, weight 0.25, confidence 0.55
• Observed at runtime: Modify Registry (T1112) (rule Modify Registry) - dynamic signal, weight 0.12, confidence 0.90

Dynamic analysis (windows)

439 behavior events · 1 ATT&CK techniques · 3 dropped files.

Runtime network

• searchapp.bundleassets.example
• www.msftconnecttest.com
• watson.events.data.microsoft.com
• 250.255.255.239.in-addr.arpa
• tas02.sls.update.microsoft.com
• ctldl.windowsupdate.com
• login.live.com
• ocsp.digicert.com
• desktop-hsgcbep
• 1.0.240.10.in-addr.arpa
• 157.36.11.23.in-addr.arpa
• 64.167.190.20.in-addr.arpa
• v10.events.data.microsoft.com
• settings-win.data.microsoft.com
• 30.73.42.20.in-addr.arpa
• 152.193.210.85.in-addr.arpa
• 2.0.0.0.1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.2.0.f.f.ip6.arpa
• 251.0.0.224.in-addr.arpa
• b.f.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.2.0.f.f.ip6.arpa
• 3.0.0.0.1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.2.0.f.f.ip6.arpa

Dropped files

• ecac1f774712981d8976fd6d43c1f2f74dc8d6414d79116bc0e0dcae73e94ea9 - ecac1f774712981d8976fd6d43c1f2f74dc8d6414d79116bc0e0dcae73e94ea9
• 448e8aeb2dcd412f100bd4271b6bc0f87d6922877f96d874d74144ec811de88c - 448e8aeb2dcd412f100bd4271b6bc0f87d6922877f96d874d74144ec811de88c
• bc2e0d15960e5ea093d25732bd7049b12405854f8c0ef7dc70da7ffb44ae9103 - bc2e0d15960e5ea093d25732bd7049b12405854f8c0ef7dc70da7ffb44ae9103

Embedded IP addresses

• 55.9.42.91
• 2.11.50.41
• 104.68.2.166
• 104.68.3.77
• 23.40.52.209
• 135.232.92.137
• 20.42.73.30
• 85.210.193.152
• 23.40.52.85
• 4.150.223.109
• 57.155.104.224
• 172.178.240.162
• 92.223.78.30
• 23.214.54.132
• 23.11.36.157
• 23.221.133.182
• 23.40.52.174
• 203.26.79.13
• 20.184.175.19
• 20.190.167.64
• 74.178.76.44
• 72.145.35.96
• 23.221.133.123
• 23.40.52.148
• 23.40.52.123

File paths

• f:\dd\vctools\crt_bld\self_x86\crt\src\mbctype.c
• f:\dd\vctools\crt_bld\self_x86\crt\src\tidtable.c
• f:\dd\vctools\crt_bld\self_x86\crt\src\stdenvp.c
• f:\dd\vctools\crt_bld\self_x86\crt\src\stdargv.c
• f:\dd\vctools\crt_bld\self_x86\crt\src\w_env.c
• f:\dd\vctools\crt_bld\self_x86\crt\src\ioinit.c
• f:\dd\vctools\crt_bld\self_x86\crt\src\onexit.c
• f:\dd\vctools\crt_bld\self_x86\crt\src\mlock.c
• f:\dd\vctools\crt_bld\self_x86\crt\src\output.c
• f:\dd\vctools\crt_bld\self_x86\crt\src\_getbuf.c
• f:\dd\vctools\crt_bld\self_x86\crt\src\_file.c
• C:\lus
• f:\dd\vctools\crt_bld\self_x86\crt\src\wctomb.c
• f:\dd\vctools\crt_bld\self_x86\crt\src\atof.c
• f:\dd\vctools\crt_bld\self_x86\crt\src\winsig.c
• f:\dd\vctools\crt_bld\self_x86\crt\src\crt0msg.c
• f:\dd\vctools\crt_bld\self_x86\crt\src\dbgrpt.c
• f:\dd\vctools\crt_bld\self_x86\crt\src\localref.c
• f:\dd\vctools\crt_bld\self_x86\crt\src\strtoq.c
• f:\dd\vctools\crt_bld\self_x86\crt\src\isctype.c
• f:\dd\vctools\crt_bld\self_x86\crt\prebuild\include\strgtold12.inl
• f:\dd\vctools\crt_bld\self_x86\crt\src\dbgheap.c
• f:\dd\vctools\crt_bld\self_x86\crt\src\errmode.c
• f:\dd\vctools\crt_bld\self_x86\crt\src\tcscat_s.inl
• f:\dd\vctools\crt_bld\self_x86\crt\src\tcsncpy_s.inl

More Azorult samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report