MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 2b9bbbaf6a14855602a42ae4fcb16003a58bf9d2c02a5e304877e8fa3de9dad5. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AZORult


Vendor detections: 5


Intelligence 5 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 2b9bbbaf6a14855602a42ae4fcb16003a58bf9d2c02a5e304877e8fa3de9dad5
SHA3-384 hash: e6237ed7cb137fdcbd51a0ddfaf20e4ad6f3c8553ab5280a08e6630884b4fc477bbc85773bfa80e0c485f0da8854b179
SHA1 hash: 32f67a788c0bc93cc6483ac3de4795841885470f
MD5 hash: c18e34a4b32e9303b6b981c1e41e1c35
humanhash: arkansas-fish-maine-winner
File name:337_99028_pdf.exe
Download: download sample
Signature AZORult
Create hunting rule
File size:1'197'056 bytes
First seen:2020-05-26 11:07:16 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash 3d95adbf13bbe79dc24dccb401c12091 (881 x AgentTesla, 737 x FormBook, 236 x SnakeKeylogger)
ssdeep 24576:ntb20pkaCqT5TBWgNQ7aJjUUaPfYeHJET6A:kVg5tQ7aJjUUaPQl5
Threatray 1'226 similar samples on MalwareBazaar
TLSH D545BE1273DE8365C7720673BA59BB21AE7BBC2905A0F45B2FD40D3FB920261561E633
Reporter abuse_ch
Tags:AZORult BGR exe geo


Avatar
abuse_ch
Malspam distributing AZORult:

HELO: s19-5bd3dd3b.smarthost.pl
Sending IP: 91.211.221.59
From: Dentsu Group inc <k.kusz@pyskowice.pl>
Subject: Fw: поръчка напомняне_337_99028_pdf
Attachment: 337_99028_pdf.iso (contains "337_99028_pdf.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
94
Origin country :
n/a
Vendor Threat Intelligence
Detection:
Azorult
Create hunting rule
Link:
https://www.capesandbox.com/analysis/4910/
Detection(s):
Sanesecurity.Malware.27686.AidExe.UNOFFICIAL
Create hunting rule

SecuriteInfo.com.PSW.Agent.BORA.UNOFFICIAL
Create hunting rule

Gathering data
Threat name:
Win32.Trojan.Injector
Create hunting rule
Status:
Malicious
First seen:
2020-05-26 11:36:51 UTC
File Type:
PE (Exe)
Extracted files:
12
AV detection:
29 of 48 (60.42%)
Threat level:
  2/5
Verdict:
malicious
Label(s):
azorult
Create hunting rule
Similar samples:
1d76e4bf41a1674e4459f76b2696e50a7e8330924654c7cfeee2f641357b87a8
AZORult
2f01b3651a057e695f79803f1f19402ee9be5c1b063e9e185735c004ea910a00
AZORult
5d0e5fe6f84c394371c174a358770010a2a1338563cf5c19659b9cb0c2d2aa69
AZORult
7cd0f0947f0485f250747fe2e8eee845d912830239a949ac721335824ee03365
AZORult
996c8fc0d84978d5827249e3573f0002535a18f0e317f31d244049bd58d74ee0
AZORult
9aece3982e025fc7385d1a971357a7857d0afdc3e5a1a550a497a47592c1b821
AZORult
a6a0f81b3e9ccf1b80fab7a213fc9ac33e396da4116af57360bff1d99621ae10
AZORult
b8cedaeefb46ff748af412d63d33b2d508966d4e33fd88efc592072b64017f5c
AZORult
c031a0c89f56acf4ad9590b807787709a0ff35e792effc0c723288106689ab10
AZORult
f2dcf747bef15584ddd0242430a2374ef9b3b3b542b25cfd75589ec2d3dc66d6
AZORult
+ 1'216 additional samples on MalwareBazaar
Result
Malware family:
azorult
Create hunting rule
Score:
  10/10
Tags:
family:azorult infostealer trojan
Link:
https://tria.ge/reports/201109-s4qs48mzja/
Behaviour
Modifies system certificate store
Suspicious use of FindShellTrayWindow
Suspicious use of SendNotifyMessage
Suspicious use of WriteProcessMemory
Suspicious use of SetThreadContext
Azorult
Malware Config
C2 Extraction:
https://livdecor.pt/work/Panel/index.php
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AZORult

iso 3ad0200de4b4feed1c3c67ec7f16704630274887be07396763fe0e97fdf23317

AZORult

Executable exe 2b9bbbaf6a14855602a42ae4fcb16003a58bf9d2c02a5e304877e8fa3de9dad5

(this sample)

  
Dropped by
MD5 d7aca7d681d805d6734e464a2e0c7489
  
Delivery method
Distributed via e-mail attachment
  
Dropped by
SHA256 3ad0200de4b4feed1c3c67ec7f16704630274887be07396763fe0e97fdf23317
Cape
Cape
https://www.capesandbox.com/analysis/4910/
Cape
Cape
https://www.capesandbox.com/analysis/4909/

Comments