MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 980fb51b13fc0116ca06b8e5d8116569942b53eb4ae54c33b62e731f149cb136. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AZORult


Vendor detections: 5


Intelligence 5 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 980fb51b13fc0116ca06b8e5d8116569942b53eb4ae54c33b62e731f149cb136
SHA3-384 hash: a1bea2ca83fd7a24fe17958023671151572ba6760dabf1d70bbc0a2198dd79d51b6f58dfc6238fe1cfc69d4bcb151a50
SHA1 hash: ba6f2484092471309cdff846434986f0eb26cfa6
MD5 hash: aa13abcbaf1697b198400cef3838565d
humanhash: september-glucose-sweet-xray
File name:gunzipped
Download: download sample
Signature AZORult
Create hunting rule
File size:599'040 bytes
First seen:2020-05-14 11:47:29 UTC
Last seen:2020-05-14 12:46:35 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash e779ecb72b7b986b17b66cff947e6d47 (4 x AgentTesla, 2 x HawkEye, 2 x Loki)
ssdeep 12288:4q5CbTUJ3RI/ZalGeojAAekg/PLOJIz75eB9whpNS+:P4cJBI/ZalysDNXSJIzZbNb
Threatray 440 similar samples on MalwareBazaar
TLSH 16D49E32F2B04833D163167D8D5B5368982BFE513E685A872BF51D4CAF39781382B297
Reporter abuse_ch
Tags:AZORult


Avatar
abuse_ch
Malspam distributing AZORult:

HELO: mail0.104.gizmodo.casa
Sending IP: 142.93.222.226
From: SAM JANAPRIYA <info@104.gizmodo.casa>
Subject: Re: PO#64683460
Attachment: PO#64683460.gz (contains "gunzipped")

Intelligence

File Origin
# of uploads :
2
# of downloads :
108
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
PUA.Win.Adware.Slugin-6803969-0
Create hunting rule

PUA.Win.Adware.Slugin-6840354-0
Create hunting rule

Gathering data
Threat name:
Win32.Trojan.Injector
Create hunting rule
Status:
Malicious
First seen:
2020-05-14 12:19:00 UTC
File Type:
PE (Exe)
Extracted files:
316
AV detection:
22 of 31 (70.97%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=tah3kgyt7qarnsqgxds5qelfngkcwu7ljlsuym5wfzzr6fe4we3a._file
Verdict:
malicious
Label(s):
azorult
Create hunting rule
Similar samples:
20a9bc3f666ce6b20c542ada396b7e3a2b222fedd94886c42a239aeb06bddda3
AZORult
4381f3472301d8b680f90832edd05d853bcef530b48f0476ce7ad1f6b150434c
AZORult
5d21ac6bca0ba98cba5930bc0ad3bc702615c3169f8fd73535f920adb8f547b3
AZORult
6db812f8cde69dfe388cc2e7f8c3275c8f1dba462374e6215722de0663af526d
AZORult
6fa68728252ed2ff5085223351da61ac8491d237707846ba016f0bd2f14f47bc
AZORult
aa699d6811b7b84893adc0734f2d1b044903ffd15d68ccde38002f34057c35fe
AZORult
c755cbe34fdad2ee86d4c6226d040ea111489e468df67a70c32cb890d1ed90ac
AZORult
e09494d2123e6999dccd6ab91cf541f90821785cd6d9a9e5f24dc296c04b857e
AZORult
f2dcf747bef15584ddd0242430a2374ef9b3b3b542b25cfd75589ec2d3dc66d6
AZORult
f519262929d4793f6fa538f80ce1a4c378b6bfa16b09cb8ac63475fd1b1bd39b
AZORult
+ 430 additional samples on MalwareBazaar
Result
Malware family:
azorult
Create hunting rule
Score:
  10/10
Tags:
family:azorult discovery infostealer trojan
Link:
https://tria.ge/reports/201109-a4r3rrmmys/
Behaviour
Checks processor information in registry
Modifies system certificate store
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: MapViewOfSection
Suspicious use of WriteProcessMemory
Suspicious use of AdjustPrivilegeToken
Program crash
Suspicious use of SetThreadContext
Checks installed software on the system
ServiceHost packer
Azorult
Malware Config
C2 Extraction:
https://sofcoholidays.com/wp-includes/js/crop/az/index.php
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AZORult

gz 293aa1d1147aca128650d17bc63ced9dbe828bc4e34cd0398e91057930b65f69

AZORult

Executable exe 980fb51b13fc0116ca06b8e5d8116569942b53eb4ae54c33b62e731f149cb136

(this sample)

  
Dropped by
MD5 769430a9b6208109c8f8d10651aa026e
  
Delivery method
Distributed via e-mail attachment
  
Dropped by
SHA256 293aa1d1147aca128650d17bc63ced9dbe828bc4e34cd0398e91057930b65f69

Comments