MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 0f1269b032abf449f574c48a6f41e50cba8fbf735c42b7b7fbe47ee50b04d9ec. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

AZORult

Vendor detections: 8

Intelligence 8 IOCs YARA 3 File information Comments

SHA256 hash:	0f1269b032abf449f574c48a6f41e50cba8fbf735c42b7b7fbe47ee50b04d9ec
SHA3-384 hash:	1d84c255d5d705c2015e9ecc8d7eaf5555763a5e0b7d630b61ff4d553f3c797812f9247263cce3aa96185857f4a2f64f
SHA1 hash:	e31ddab6934bcd76d9227eb22d8a01f0a9efe866
MD5 hash:	f8c46009eec65e51e583fc0eea2b409e
humanhash:	timing-arizona-uniform-sad
File name:	INVDOC.exe
Download:	download sample
Signature	AZORult Create hunting rule
File size:	397'768 bytes
First seen:	2020-06-26 11:50:41 UTC
Last seen:	2020-06-26 12:39:30 UTC
File type:	exe
MIME type:	application/x-dosexec
imphash	f34d5f2d4577ed6d9ceec516c1f5a744 (48'652 x AgentTesla, 19'462 x Formbook, 12'204 x SnakeKeylogger)
ssdeep	6144:ho76VaFBNg88ZNaV9s02RoJfeCvDAP/lYHOsxXU:KjFBSTaV4mfeWc+na
Threatray	172 similar samples on MalwareBazaar
TLSH	07849E2BB6816636C02846F58C4F90D552367A203E365A1FB1EAE71CDDB06C37F592CB
Reporter	abuse_ch
Tags:	AZORult exe

abuse_ch

Malspam distributing AZORult:

HELO: vps100.domain.local
Sending IP: 111.90.149.22
From: sales@nts-agrer.de
Subject: Re: New order
Attachment: INVDOC.zip (contains "INVDOC.exe")

Intelligence

File Origin

# of uploads :

# of downloads :

205

Origin country :

n/a

Vendor Threat Intelligence

Detection:

Azorult

Link:

https://www.capesandbox.com/analysis/14886/

Detection(s):

SecuriteInfo.com.Trojan.PackedNET.349.UNOFFICIAL

Result

Verdict:

Malware

Maliciousness:

Behaviour

Creating a file in the %temp% directory

Creating a window

Creating a process from a recently created file

Creating a file

Unauthorized injection to a recently created process

Unauthorized injection to a recently created process by context flags manipulation

Sending an HTTP POST request to an infection source

Detection:

azorult

Link:

https://mwdb.cert.pl/sample/0f1269b032abf449f574c48a6f41e50cba8fbf735c42b7b7fbe47ee50b04d9ec/

Threat name:

Win32.Trojan.AgentTesla

Status:

Malicious

First seen:

2020-06-26 11:52:06 UTC

AV detection:

25 of 31 (80.65%)

Threat level:

5/5

Detection(s):

Malicious file

Link:

https://check.spamhaus.org/check/?searchterm=b4jgtmbsvp2et5luysfg6qpfbs5i7p3tlrblpn734r7okcye3hwa._file

Verdict:

malicious

Label(s):

azorult

Result

Malware family:

azorult

Score:

10/10

Tags:

trojan infostealer family:azorult spyware discovery

Link:

https://tria.ge/reports/200626-gk73l6mbnj/

Behaviour

Suspicious use of AdjustPrivilegeToken

Delays execution with timeout.exe

Checks processor information in registry

Suspicious behavior: EnumeratesProcesses

Suspicious use of WriteProcessMemory

Suspicious use of SetThreadContext

Checks for installed software on the system

Loads dropped DLL

Reads user/profile data of web browsers

Reads user/profile data of local email clients

Reads data files stored by FTP clients

Executes dropped EXE

Azorult

Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	Azorult Create hunting rule
Author:	JPCERT/CC Incident Response Group
Description:	detect Azorult in memory
Reference:	internal research

Rule name:	Trojan_W32_Gh0stMiancha_1_0_0 Create hunting rule

Rule name:	win_azorult_auto Create hunting rule
Author:	Felix Bilstein - yara-signator at cocacoding dot com
Description:	autogenerated rule brought to you by yara-signator