MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 136c712a4729d8e0ee867ad0d5b9ecfe69a77191af02d4d38586ec6cdd0a3235. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AZORult


Vendor detections: 5


Intelligence 5 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 136c712a4729d8e0ee867ad0d5b9ecfe69a77191af02d4d38586ec6cdd0a3235
SHA3-384 hash: b8c8eb2611e3778539cd2e1bb12ffaf15d94ed7052690c2ac3ca6935344e9eab8fb4689fef06811dc316627a6bcd0af6
SHA1 hash: 2e58a3f52dd07a3f7210f6340616aa7df5476682
MD5 hash: e81b5d3460b29d9eb4c13ae1c9025c26
humanhash: king-romeo-mars-georgia
File name:PICTURE FOR ILLUSTRATION.exe
Download: download sample
Signature AZORult
Create hunting rule
File size:1'499'136 bytes
First seen:2020-05-19 06:47:14 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash afcdf79be1557326c854b6e20cb900a7 (1'102 x FormBook, 936 x AgentTesla, 399 x RemcosRAT)
ssdeep 24576:CCdxte/80jYLT3U1jfsWaAAGBYsY2d9aQZB1DLvG/GI1L9WpRUu8Q:Tw80cTsjkWaAAk+s1EBsr
Threatray 1'107 similar samples on MalwareBazaar
TLSH 0565D02273DDC360CB669173BF6A77016EBF38614630B95B2F980D7CA950172262DB63
Reporter abuse_ch
Tags:AZORult exe


Avatar
abuse_ch
Malspam distributing AZORult:

HELO: 77-72-3-56.hosted-at.kloud.co.uk
Sending IP: 77.72.3.56
From: Talaat Shawky <info@powerplus.us>
Reply-To: Talaat Shawky <biz@ngyusa.com>
Subject: YANAR Trading - RFQ Products.
Attachment: PICTURE FOR ILLUSTRATION.zip (contains "PICTURE FOR ILLUSTRATION.exe")

AZORult C2:
http://82.165.103.210/index.php

Intelligence

File Origin
# of uploads :
1
# of downloads :
108
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Sanesecurity.Malware.27686.AidExe.UNOFFICIAL
Create hunting rule

SecuriteInfo.com.Trojan.PWS.Stealer.19347.UNOFFICIAL
Create hunting rule

Gathering data
Threat name:
Win32.Trojan.Injector
Create hunting rule
Status:
Malicious
First seen:
2020-05-19 07:17:00 UTC
File Type:
PE (Exe)
Extracted files:
26
AV detection:
28 of 31 (90.32%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=cnwhckshfhmob3ugplinlopm7zu2o4mrv4bnju4fq3wgzxikgi2q._file
Verdict:
malicious
Label(s):
azorult
Create hunting rule
Similar samples:
2e3068fbfcc72172efda05ac44c3a23658d575a9125abefa62e42eb3c0983df1
AZORult
33318539cfd16ce1d6f1cd45885d39c5534b8ccc6a81a64b53fb890b96fd9cee
AZORult
4b110258d8a90160fd07abfd441805de6b8e1cb646c0734febd7de606ca5a4e4
AZORult
4b21bb475e5ceddb95ce17345517a9369fac1b0fbcd10365c7a739923f3f524f
AZORult
7cb0f80624431e1745d162ee3c2a4a25744f8d8fcbd95fe3c54f94214e826e0d
AZORult
95034687c0234adc6400e0cce0f13db71b230fd428dcf9ba540083a34edc7eb8
AZORult
cb0a3504bf404124f83e0f9db5453ba1f1943f73dd19196a5b7d780ad2213bec
AZORult
ded450af998de45b6a1ac415f262e047e7bd173b152e61d2cbe26877ddafe706
AZORult
e3a46e240ed1f39b798492114fb14364dfbfec082864f13e5e17a44f31ff037d
AZORult
f493c862fa7986b42ed93e8a83f7492b4047b258d1fcb92bf17dc4edffaf45f9
AZORult
+ 1'097 additional samples on MalwareBazaar
Result
Malware family:
azorult
Create hunting rule
Score:
  10/10
Tags:
family:azorult infostealer trojan
Link:
https://tria.ge/reports/201109-fyyqekp9r2/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of FindShellTrayWindow
Suspicious use of SendNotifyMessage
Suspicious use of WriteProcessMemory
Suspicious use of SetThreadContext
Azorult
Malware Config
C2 Extraction:
http://82.165.103.210/index.php
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AZORult

zip e0fc42f409bf4989dc1d4467f3c3ad6c6ae44e72db627da14497b389a62161dc

AZORult

Executable exe 136c712a4729d8e0ee867ad0d5b9ecfe69a77191af02d4d38586ec6cdd0a3235

(this sample)

  
Dropped by
MD5 1fc6cf84d93da59d22f0e71982204d13
  
Delivery method
Distributed via e-mail attachment
  
Dropped by
SHA256 e0fc42f409bf4989dc1d4467f3c3ad6c6ae44e72db627da14497b389a62161dc

Comments