MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 b8cedaeefb46ff748af412d63d33b2d508966d4e33fd88efc592072b64017f5c. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AZORult


Vendor detections: 5


Intelligence 5 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: b8cedaeefb46ff748af412d63d33b2d508966d4e33fd88efc592072b64017f5c
SHA3-384 hash: 3043c77edc15d2892f87a42121ca9a570a4b6227f61070e73e1066ff62a07aadc1a5527764ad6a97fdcd103b08364b1a
SHA1 hash: 6aea28ca385792ced87b2cfb702469574b36cfe5
MD5 hash: 9b18816e3b13b8445f2b8774aed72b08
humanhash: lactose-stairway-berlin-eleven
File name:Rabih Trading LLC Dubai.exe
Download: download sample
Signature AZORult
Create hunting rule
File size:1'121'792 bytes
First seen:2020-06-02 06:55:52 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash 3d95adbf13bbe79dc24dccb401c12091 (881 x AgentTesla, 737 x FormBook, 236 x SnakeKeylogger)
ssdeep 12288:ptb20Qc3lT7af41ePBRYuQLKpqeUhbTv5OFgNuPPpHSga1T03F8LqCr/xEZ41lQa:ptb20pkaCqT5TBWgNQ7aheFeEqog56A
Threatray 1'359 similar samples on MalwareBazaar
TLSH F135CF1363DD8361C7B25273BA26B7017EBF782506A1F96B2FD8093DF920122525E673
Reporter abuse_ch
Tags:AZORult exe


Avatar
abuse_ch
Malspam distributing AZORult:

HELO: 77-72-3-56.hosted-at.kloud.co.uk
Sending IP: 77.72.3.56
From: Rabih Trading LLC <rabih@emirates.net.ae>
Reply-To: Anand Gupta <rabih@emirates.net.ae>, Rabih <boxerindie27@gmail.com>
Subject: New Inquiry: Product Specification(PS70045 & PS70046)
Attachment: Rabih Trading LLC Dubai.zip (contains "Rabih Trading LLC Dubai.exe")

AZORult C2:
http://51.116.180.53/index.php

Intelligence

File Origin
# of uploads :
1
# of downloads :
85
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Sanesecurity.Malware.27686.AidExe.UNOFFICIAL
Create hunting rule

SecuriteInfo.com.PSW.Agent.BORA.UNOFFICIAL
Create hunting rule

Gathering data
Threat name:
Win32.Trojan.Injector
Create hunting rule
Status:
Malicious
First seen:
2020-06-01 23:02:05 UTC
File Type:
PE (Exe)
Extracted files:
26
AV detection:
26 of 31 (83.87%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=xdhnv3x3i37xjcxuclld2m5s2uejm3kogp6yr36fsidswzabp5oa._file
Verdict:
malicious
Label(s):
azorult
Create hunting rule
Similar samples:
007ac20801e4bd954545cdcd275522fb87687179ed8dd160ceb6e906998a0558
AZORult
2b9bbbaf6a14855602a42ae4fcb16003a58bf9d2c02a5e304877e8fa3de9dad5
AZORult
2f01b3651a057e695f79803f1f19402ee9be5c1b063e9e185735c004ea910a00
AZORult
5d0e5fe6f84c394371c174a358770010a2a1338563cf5c19659b9cb0c2d2aa69
AZORult
7cd0f0947f0485f250747fe2e8eee845d912830239a949ac721335824ee03365
AZORult
9aece3982e025fc7385d1a971357a7857d0afdc3e5a1a550a497a47592c1b821
AZORult
a6a0f81b3e9ccf1b80fab7a213fc9ac33e396da4116af57360bff1d99621ae10
AZORult
c031a0c89f56acf4ad9590b807787709a0ff35e792effc0c723288106689ab10
AZORult
f2dcf747bef15584ddd0242430a2374ef9b3b3b542b25cfd75589ec2d3dc66d6
AZORult
f5053d63c375cee3c53f33df04dc76dfaa3560c35bb5f166e8238804e3ba3204
AZORult
+ 1'349 additional samples on MalwareBazaar
Result
Malware family:
azorult
Create hunting rule
Score:
  10/10
Tags:
family:azorult infostealer trojan
Link:
https://tria.ge/reports/201109-8awy1nvnj2/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of FindShellTrayWindow
Suspicious use of SendNotifyMessage
Suspicious use of WriteProcessMemory
Suspicious use of SetThreadContext
Azorult
Malware Config
C2 Extraction:
http://51.116.180.53/index.php
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AZORult

zip 19f50940507472ca2d33eaf199911ab9c9451e5610e6b55f7ce443b08680ca82

AZORult

Executable exe b8cedaeefb46ff748af412d63d33b2d508966d4e33fd88efc592072b64017f5c

(this sample)

  
Dropped by
MD5 079072fba5561c44cbc6e1c596f400a6
  
Delivery method
Distributed via e-mail attachment
  
Dropped by
SHA256 19f50940507472ca2d33eaf199911ab9c9451e5610e6b55f7ce443b08680ca82

Comments