MALICIOUS — a19d2e5429a8643cfbcfd49d2dbe27228196a905d6cd43ca3d5fbdd6c0e048ca

MALICIOUS — a19d2e5429a8643cfbcfd49d2dbe27228196a905d6cd43ca3d5fbdd6c0e048ca is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (100/100), attributed to the Azorult family. 6 of 56 detection engines flagged it.

Identification

SHA-256: a19d2e5429a8643cfbcfd49d2dbe27228196a905d6cd43ca3d5fbdd6c0e048ca
SHA-1: 43789dc33002a44d8db997e05aa4f4be2d3f5f81
MD5: 28572413cd47a407ca1287ecfdda33e0
imphash: 618406fbb822203fe0a0c735aaa630a3
ssdeep: 49152:QkhVrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrr:Qk
TLSH: T13B6D4BB9A4E1358BCC61BA56B47B808D2E30E80E0733BF016459D15B7572F5787C8A8B
Submitted as: a19d2e5429a8643cfbcfd49d2dbe27228196a905d6cd43ca3d5fbdd6c0e048ca
File type: pe · Size: 12616192 bytes
Verdict: malicious (100/100) · Family: Azorult

Detections (6 of 56 engines)

ClamAV (daily): Win.Trojan.Generic-9906195-0
YARA: Yara-Rules community: YR_AntiDebug_Checks
Microsoft Defender: Trojan:Win32/Azorult.RW!MTB
Emsisoft (Emergency Kit): Gen:Heur.Mint.Zard.52
Trellix Stinger (McAfee): Packed-GDT!28572413CD47
Kaspersky (KVRT): HEUR:Backdoor.Win32.Tofsee.gen

Why this verdict

The malicious score of 100/100 is the fusion of 10 weighted signals:

ClamAV (daily) flagged Win.Trojan.Generic-9906195-0 (rule Win.Trojan.Generic-9906195-0) - engine signal, weight 0.90, confidence 0.95
Microsoft Defender flagged Trojan:Win32/Azorult.RW!MTB (rule Trojan:Win32/Azorult.RW!MTB) - engine signal, weight 0.55, confidence 0.85
Emsisoft (Emergency Kit) flagged Gen:Heur.Mint.Zard.52 (rule Gen:Heur.Mint.Zard.52) - engine signal, weight 0.55, confidence 0.85
Trellix Stinger (McAfee) flagged Packed-GDT!28572413CD47 (rule Packed-GDT!28572413CD47) - engine signal, weight 0.55, confidence 0.85
Kaspersky (KVRT) flagged HEUR:Backdoor.Win32.Tofsee.gen (rule HEUR:Backdoor.Win32.Tofsee.gen) - engine signal, weight 0.55, confidence 0.85
Contacted 3 HTTP request(s) at runtime - network signal, weight 0.40, confidence 0.80
Extracted Tofsee config (0 C2) - engine signal, weight 0.45, confidence 0.60
YARA: Yara-Rules community flagged YR_AntiDebug_Checks (rule YR_AntiDebug_Checks) - engine signal, weight 0.35, confidence 0.70
Embedded network infrastructure: 55.9.42.91, 2.8.50.21 - static signal, weight 0.35, confidence 0.60
Memory forensics: 4 finding(s) elsewhere in the guest, not attributed to this sample, e.g. RWX/private injected region in SppExtComObj.E (pid 7432) (rule windows.malfind.Malfind) - memory signal, weight 0.05, confidence 0.30

Dynamic analysis (windows)

15 behavior events · 0 ATT&CK techniques · 3 dropped files.

Dropped files

ecac1f774712981d8976fd6d43c1f2f74dc8d6414d79116bc0e0dcae73e94ea9 - ecac1f774712981d8976fd6d43c1f2f74dc8d6414d79116bc0e0dcae73e94ea9
448e8aeb2dcd412f100bd4271b6bc0f87d6922877f96d874d74144ec811de88c - 448e8aeb2dcd412f100bd4271b6bc0f87d6922877f96d874d74144ec811de88c
c0ead1139dfb9374df89230aabb232b970b49560d55445eb44b1e8135a18bc1d - c0ead1139dfb9374df89230aabb232b970b49560d55445eb44b1e8135a18bc1d

Embedded URLs

http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl

Embedded IP addresses

55.9.42.91
2.8.50.21
4.150.223.102
4.230.171.124
4.144.132.114
104.18.33.89
135.233.45.221
4.150.223.106
52.110.12.4
52.110.12.54

File paths

f:\dd\vctools\crt_bld\self_x86\crt\src\_file.c
f:\dd\vctools\crt_bld\self_x86\crt\src\_sftbuf.c
f:\dd\vctools\crt_bld\self_x86\crt\src\ioinit.c
f:\dd\vctools\crt_bld\self_x86\crt\src\stdenvp.c
f:\dd\vctools\crt_bld\self_x86\crt\src\stdargv.c
f:\dd\vctools\crt_bld\self_x86\crt\src\w_env.c
f:\dd\vctools\crt_bld\self_x86\crt\src\tidtable.c
f:\dd\vctools\crt_bld\self_x86\crt\src\mbctype.c
f:\dd\vctools\crt_bld\self_x86\crt\src\mlock.c
f:\dd\vctools\crt_bld\self_x86\crt\src\_getbuf.c
f:\dd\vctools\crt_bld\self_x86\crt\src\onexit.c
f:\dd\vctools\crt_bld\self_x86\crt\src\output.c
C:\bomayel\pufo.pdb
f:\dd\vctools\crt_bld\self_x86\crt\src\puts.c
f:\dd\vctools\crt_bld\self_x86\crt\src\strtol.c
f:\dd\vctools\crt_bld\self_x86\crt\src\_flsbuf.c
f:\dd\vctools\crt_bld\self_x86\crt\src\fwrite.c
f:\dd\vctools\crt_bld\self_x86\crt\src\fileno.c
f:\dd\vctools\crt_bld\self_x86\crt\src\dbgrpt.c
f:\dd\vctools\crt_bld\self_x86\crt\src\dbgheap.c
f:\dd\vctools\crt_bld\self_x86\crt\src\crt0msg.c
f:\dd\vctools\crt_bld\self_x86\crt\src\intel\fp8.c
f:\dd\vctools\crt_bld\self_x86\crt\prebuild\conv\cvt.c
f:\dd\vctools\crt_bld\self_x86\crt\src\isctype.c
f:\dd\vctools\crt_bld\self_x86\crt\src\localref.c

More Azorult samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report