MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 a6a0f81b3e9ccf1b80fab7a213fc9ac33e396da4116af57360bff1d99621ae10. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

AZORult

Vendor detections: 5

Intelligence 5 IOCs YARA File information Comments

SHA256 hash:	a6a0f81b3e9ccf1b80fab7a213fc9ac33e396da4116af57360bff1d99621ae10
SHA3-384 hash:	879442c824d1c774da641137be839041f6e0f4629d1bdc3d44c5c1398102ed8ae7b2ef6e32e8f72dc2777f48c9f7d6e4
SHA1 hash:	904cc2b84720cbc70552f8dfb94fec12987bec2c
MD5 hash:	f773973e189c667a940e3dc72acc6546
humanhash:	moon-tango-diet-zebra
File name:	PICTURE FOR ILLUSTRATION.exe
Download:	download sample
Signature	AZORult Create hunting rule
File size:	1'138'176 bytes
First seen:	2020-06-04 06:42:53 UTC
Last seen:	Never
File type:	exe
MIME type:	application/x-dosexec
imphash	3d95adbf13bbe79dc24dccb401c12091 (881 x AgentTesla, 737 x FormBook, 236 x SnakeKeylogger)
ssdeep	12288:8tb20Qc3lT7af41ePBRYuQLKpqeUhbTv5OFgNuPPpHSgaETynau3zoLTV/w6yH9j:8tb20pkaCqT5TBWgNQ7akgyL5YFhN6A
Threatray	1'199 similar samples on MalwareBazaar
TLSH	0535CF1373DE8361C3B25273BA15B701BEBF782506A5F56B2FD8093DE820162525EA73
Reporter	abuse_ch
Tags:	AZORult exe

abuse_ch

Malspam distributing AZORult:

HELO: 77-72-3-56.hosted-at.kloud.co.uk
Sending IP: 77.72.3.56
From: Rabih Trading LLC <rabih@emirates.net.ae>
Reply-To: Anand Gupta <rabih@emirates.net.ae>, Rabih <boxerindie27@gmail.com>
Subject: New Inquiry: Product Specification (PS70045 & PS70046)
Attachment: PICTURE FOR ILLUSTRATION.zip (contains "PICTURE FOR ILLUSTRATION.exe")

AZORult C2:
http://51.116.180.53/index.php

Intelligence

File Origin

# of uploads :

# of downloads :

127

Origin country :

n/a

Vendor Threat Intelligence

Detection(s):

Sanesecurity.Malware.27684.AidExe.UNOFFICIAL

Sanesecurity.Malware.27686.AidExe.UNOFFICIAL

SecuriteInfo.com.PSW.Agent.BORA.UNOFFICIAL

Gathering data

Threat name:

Win32.Trojan.Aitinject

Status:

Malicious

First seen:

2020-06-04 06:07:04 UTC

AV detection:

29 of 48 (60.42%)

Threat level:

2/5

Detection(s):

Malicious file

Link:

https://check.spamhaus.org/check/?searchterm=u2qpqgz6tthrxah2w6rbh7e2ym7ds3necfvpk43ax7y5tfrbvyia._file

Verdict:

malicious

Label(s):

azorult

Result

Malware family:

azorult

Score:

10/10

Tags:

family:azorult infostealer trojan

Link:

https://tria.ge/reports/201109-mf5m7lmqyj/

Behaviour

Suspicious behavior: EnumeratesProcesses

Suspicious use of FindShellTrayWindow

Suspicious use of SendNotifyMessage

Suspicious use of WriteProcessMemory

Suspicious use of SetThreadContext

Azorult

Malware Config

C2 Extraction:

http://51.116.180.53/index.php

Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AZORult

zip 89ca7b3a1db6c00430e15557a6b11e054cf05454446a2d50cb8edb2e2aa53cae

AZORult

exe a6a0f81b3e9ccf1b80fab7a213fc9ac33e396da4116af57360bff1d99621ae10

(this sample)

Dropped by

MD5 a97b14f37daf0514c36047b43e795392

Delivery method

Distributed via e-mail attachment

Dropped by

SHA256 89ca7b3a1db6c00430e15557a6b11e054cf05454446a2d50cb8edb2e2aa53cae

Comments

Login required

You need to login to in order to write a comment. Login with your abuse.ch account.

No comments found for this malware sample