MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 adf1ab026877202ab0e3ef9af0576336f151c36b8980b5456b4b2c3c0e592f7d. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AZORult


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: adf1ab026877202ab0e3ef9af0576336f151c36b8980b5456b4b2c3c0e592f7d
SHA3-384 hash: 2d0e27027cb537af96ca53e8be95537157ea26718d55e7c18a2f9952cd8918598211488e8497c0219654074176941f64
SHA1 hash: 276defa7bb0e467b7852646c50d9cb8ecc8e11ab
MD5 hash: 2852a6e00dca22bb9ee360858676aa9c
humanhash: timing-steak-washington-double
File name:SecuriteInfo.com.Trojan.PWS.Siggen2.49052.630.17031
Download: download sample
Signature AZORult
Create hunting rule
File size:220'672 bytes
First seen:2020-05-20 01:35:46 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'652 x AgentTesla, 19'463 x Formbook, 12'204 x SnakeKeylogger)
ssdeep 6144:GGpv0FFn0aP2f9bUXxGMUCbmCdadmn95s7M+AW:zsn0KWmXxAWmKB
Threatray 380 similar samples on MalwareBazaar
TLSH 8F24E19027AC6FB2D93E9FF03622201547FA7566F502EF4D0EC170E616A7F111AA0DA7
Reporter SecuriteInfoCom
Tags:AZORult

Intelligence

File Origin
# of uploads :
1
# of downloads :
108
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Trojan.PWS.Siggen2.49052.630.17031.UNOFFICIAL
Create hunting rule

Gathering data
Threat name:
ByteCode-MSIL.Trojan.Kryptik
Create hunting rule
Status:
Malicious
First seen:
2020-05-19 17:46:09 UTC
File Type:
PE (.Net Exe)
Extracted files:
9
AV detection:
25 of 31 (80.65%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=vxy2watio4qcvmhd56npav3dg3yvdq3lrgalkrlljmwdydszf56q._file
Verdict:
malicious
Label(s):
azorult
Create hunting rule
Similar samples:
05a1356768e4475daeebaae76e486705d2d920e7e4d511c1436ea3f9a650c1df
AZORult
151f57078e89aa2f81fcb307bf88fe23e9f2437a4df1e37def5d0b78797e12f8
AZORult
308c96557c6be5d4519ba4bac38c23e611c7b61683cfc1063a6009e216c24f5e
AZORult
573f11821c72786131d82bcdb3744b83d01615c25489f4cf2c46181ae6143226
AZORult
6b4c217c0bdb4660db2d83a8deb9e538e801e8c275e5e1fe955497970daf24c0
AZORult
7e9b9bbb673e25ab8ee790dbfd2a3e489c0d3a88ab73aafe671f68982f1b41da
AZORult
81337231c53d0927b5aaff1792d71b5f5270e268e1909267ad3bd79951e72642
AZORult
9e17a9c1b1d0db2c9cd8fdf42c475712f8faaa68cb08bbff910a2927b910d88f
AZORult
9ffc0cc7f5b6bfb1e02d404b6d850e2fd72a778a1a2582fc061723f084cc73c2
AZORult
e539fe1b7096b7a1966ebbe10e2361c05fd90adf8ed312406f90efe13744e5af
AZORult
+ 370 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  9/10
Tags:
n/a
Link:
https://tria.ge/reports/201109-cxbymvxkwx/
Behaviour
Suspicious use of WriteProcessMemory
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

AZORult

Executable exe adf1ab026877202ab0e3ef9af0576336f151c36b8980b5456b4b2c3c0e592f7d

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/365017/
  
Delivery method
Distributed via web download

Comments