MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 0fa48ae85f61923503631667a6982f655b03a66ca2c96b4d73dd0ca9ae75fdf7. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AZORult


Vendor detections: 5


Intelligence 5 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 0fa48ae85f61923503631667a6982f655b03a66ca2c96b4d73dd0ca9ae75fdf7
SHA3-384 hash: 0b952505e7a1d3d15887b2b75c03cbf48adfeee08a175e1c5093f1bc5a7e92a2c0847b1dfe763b944706bf72517d2cb1
SHA1 hash: 2f0fce96a48c2b3f1c5c2e7cccd63f0874a9a4d5
MD5 hash: b986a44ac5e456af1213e0de14b89fe0
humanhash: friend-ink-three-ten
File name:purchase order.exe
Download: download sample
Signature AZORult
Create hunting rule
File size:372'736 bytes
First seen:2020-06-08 08:39:33 UTC
Last seen:2020-06-08 14:31:16 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'652 x AgentTesla, 19'463 x Formbook, 12'204 x SnakeKeylogger)
ssdeep 6144:b6FT3y2hQBJKKN/ofGbGaianL4HUaF7cdYivFkdbIa:b6HfUGlancHUQAS8a
Threatray 557 similar samples on MalwareBazaar
TLSH 5B84CE012A889B2AFD6F03F5CC5A124D77F16D966722EAEA4DC17BB9047DB00467063F
Reporter jarumlus
Tags:AZORult

Intelligence

File Origin
# of uploads :
4
# of downloads :
134
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Trojan.GenericKD.43303588.21204.32743.UNOFFICIAL
Create hunting rule

Gathering data
Threat name:
Win32.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2020-06-08 02:03:59 UTC
File Type:
PE (.Net Exe)
Extracted files:
20
AV detection:
27 of 31 (87.10%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=b6siv2c7mgjdka3dczt2ngbpmvnqhjtmulewwtlt3ugktltv7x3q._file
Verdict:
malicious
Label(s):
azorult
Create hunting rule
Similar samples:
0d4623e27386fcbb4755a97f2552b141f7ffd67b56feea2768c49920bd0b081d
AZORult
2e8f8383cfdb7a42c9e5ced3469619f6154b874616a2dd793693f3b53ec5cae7
AZORult
32e7be2844e7be1f6ae7d262eeebe64926946ebbc8e2d91ce3760b8e1d10285c
AZORult
740ad559a3b83f05776ac9f2c650c3d6268d63848c556770c57a9e6edd9f03f5
AZORult
7d01a97eb5e90a8c74c6a16961ab1a1bff4a1408779e46cf769bb5889d2d44bc
AZORult
c50ba6556752607323e0e14d5429961d9af3804d9b45f8c7755ec1709efc6af3
AZORult
dd1dbd01bac8f1ba75f1279f9684e5f6a706559acaa2db285697c5f5e3258a31
AZORult
dfca8cf09994229afec678b5c279d247e3e69c45f2878f816025b4933f3bc3b0
AZORult
f61fba92541b23921c7904cd689121c68b8bf69780220586227bf01c9816c68d
AZORult
f669e4406244692e23e031d355e53b51dee1b96f1e988172a2b1eabcd0d82292
AZORult
+ 547 additional samples on MalwareBazaar
Result
Malware family:
azorult
Create hunting rule
Score:
  10/10
Tags:
family:azorult discovery infostealer rezer0 spyware trojan
Link:
https://tria.ge/reports/201109-gr9dlnyekn/
Behaviour
Checks processor information in registry
Creates scheduled task(s)
Suspicious behavior: EnumeratesProcesses
Suspicious use of WriteProcessMemory
Suspicious use of SetThreadContext
Accesses cryptocurrency files/wallets, possible credential harvesting
Checks installed software on the system
JavaScript code in executable
Loads dropped DLL
Reads data files stored by FTP clients
Reads user/profile data of local email clients
Reads user/profile data of web browsers
ServiceHost packer
rezer0
Azorult
Malware Config
C2 Extraction:
http://iscm.edu.ar/gold/32/index.php
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AZORult

gz d01c761c16540f44793ff375500404670a00d13a6c1e49da228a083cd069565a

AZORult

Executable exe 0fa48ae85f61923503631667a6982f655b03a66ca2c96b4d73dd0ca9ae75fdf7

(this sample)

  
Dropped by
MD5 6687124fc6fc8e3bbd2945f8195758fd
  
Dropped by
SHA256 d01c761c16540f44793ff375500404670a00d13a6c1e49da228a083cd069565a
  
Dropped by
AZORult
  
Delivery method
Distributed via e-mail attachment

Comments