MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 7cd0f0947f0485f250747fe2e8eee845d912830239a949ac721335824ee03365. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AZORult


Vendor detections: 5


Intelligence 5 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 7cd0f0947f0485f250747fe2e8eee845d912830239a949ac721335824ee03365
SHA3-384 hash: 26c6a18d6dba30fae94105d35d79db37f7152adb884f22860daea49482fdaae42d94dd526620e1094a469ea49ae13703
SHA1 hash: d9b39d7fda6d314b4c49b5d5dc9e634ee14448df
MD5 hash: dd02d84951a6b48b98f08abd3f79a278
humanhash: shade-batman-enemy-cup
File name:NSL SUGARS LTD UNIT.exe
Download: download sample
Signature AZORult
Create hunting rule
File size:1'293'824 bytes
First seen:2020-05-10 14:20:21 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash 3d95adbf13bbe79dc24dccb401c12091 (881 x AgentTesla, 737 x FormBook, 236 x SnakeKeylogger)
ssdeep 24576:Ktb20pkaCqT5TBWgNQ7aASYYEV6L2wPPAdkhp/B5HJLg6A:3Vg5tQ7aAsEOBgdwpG5
Threatray 1'229 similar samples on MalwareBazaar
TLSH 5055D01373DD8364C7B25273BA25B741AEBF782506A1F96B2FD4093DB820162521EB73
Reporter abuse_ch
Tags:AZORult exe


Avatar
abuse_ch
Malspam distributing AZORult:

HELO: cpanel02.datacenter.az
Sending IP: 94.20.30.207
From: M. Prabahkar Rao, Chairman, NSL Group <enquiryjaymahesh@nslisiugars.com>
Reply-To: M. Prabahkar Rao <biz@ngyusa.com>
Subject: PROJECT DRAFT - Enquiry - 45666003
Attachment: NSL SUGARS LTD UNIT.zip (contains "NSL SUGARS LTD UNIT.exe")

AZORult C2:
http://49.12.98.113/index.php

Intelligence

File Origin
# of uploads :
1
# of downloads :
148
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Sanesecurity.Malware.27686.AidExe.UNOFFICIAL
Create hunting rule

SecuriteInfo.com.PSW.Agent.BORA.UNOFFICIAL
Create hunting rule

Gathering data
Threat name:
Win32.Trojan.Feuxdwr
Create hunting rule
Status:
Malicious
First seen:
2020-05-10 12:30:12 UTC
File Type:
PE (Exe)
Extracted files:
26
AV detection:
26 of 31 (83.87%)
Threat level:
  2/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=ptipbfd7asc7eudup7ror3xiixmrfaychguutldscm2yetxagnsq._file
Verdict:
malicious
Label(s):
azorult
Create hunting rule
Similar samples:
14fd527270413bbe03889b5082000818055ae981fd2ea0df41f24ff34c7c4621
AZORult
2f01b3651a057e695f79803f1f19402ee9be5c1b063e9e185735c004ea910a00
AZORult
39d0b2e8bf25731fec53c37d0f245734f777878ccfead2173e4ae4eca52f345e
AZORult
69a72a4e6627e9d4f81f2a4a7d83438fa05301a909093a2e86284d2bd3f9bbaf
AZORult
892dabc0bda34c580ef8124ddc7b02ae6afc32edf84f351d6504aafa4d21c917
AZORult
9aece3982e025fc7385d1a971357a7857d0afdc3e5a1a550a497a47592c1b821
AZORult
a500f27709fb009950d25abae11f25c6e8e0205d15931530467ecfb342a661ad
AZORult
b8cedaeefb46ff748af412d63d33b2d508966d4e33fd88efc592072b64017f5c
AZORult
f8166e1205c9dd0761f42f47c8d3e3c944b72b1fd3713a0383040f263987a649
AZORult
fb3010b0874dffd1d587f2a8a1b73eb444085f853070f71dbf0012a5fa7fcdf0
AZORult
+ 1'219 additional samples on MalwareBazaar
Result
Malware family:
azorult
Create hunting rule
Score:
  10/10
Tags:
family:azorult infostealer trojan
Link:
https://tria.ge/reports/201109-jzy4vxwhvs/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of FindShellTrayWindow
Suspicious use of SendNotifyMessage
Suspicious use of WriteProcessMemory
Suspicious use of SetThreadContext
Azorult
Malware Config
C2 Extraction:
http://49.12.98.113/index.php
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AZORult

zip 4be254737e7b1971585ad23913a73d534a260a864a758253ef134d30b103da1e

AZORult

Executable exe 7cd0f0947f0485f250747fe2e8eee845d912830239a949ac721335824ee03365

(this sample)

  
Dropped by
MD5 dda8516fd0caf772f65b3e59a7549b29
  
Delivery method
Distributed via e-mail attachment
  
Dropped by
SHA256 4be254737e7b1971585ad23913a73d534a260a864a758253ef134d30b103da1e

Comments