MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 f5053d63c375cee3c53f33df04dc76dfaa3560c35bb5f166e8238804e3ba3204. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AZORult


Vendor detections: 5


Intelligence 5 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: f5053d63c375cee3c53f33df04dc76dfaa3560c35bb5f166e8238804e3ba3204
SHA3-384 hash: f12757c174b14c0909e9be601ea4dd4b04aef2e711002794d8c1e169c1d9e3b4eb757b11af223985bbf586533042766a
SHA1 hash: e75450cdd0a7e1c93a0f215064e974ab5e1ab768
MD5 hash: 1a2d79996f534571873d714d86863814
humanhash: double-island-finch-cola
File name:Order Specification.exe
Download: download sample
Signature AZORult
Create hunting rule
File size:1'162'240 bytes
First seen:2020-05-13 06:49:17 UTC
Last seen:2020-05-29 14:57:25 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash 3d95adbf13bbe79dc24dccb401c12091 (881 x AgentTesla, 737 x FormBook, 236 x SnakeKeylogger)
ssdeep 24576:Ftb20pkaCqT5TBWgNQ7aDbwDjUwP35NrrsJhyKEq6A:2Vg5tQ7aDbUPNut5
Threatray 1'188 similar samples on MalwareBazaar
TLSH 7135C01373DEC361C3725273BA267741AEBF782506A5F56B2FD8093DA920122521EB73
Reporter abuse_ch
Tags:AZORult exe


Avatar
abuse_ch
Malspam distributing unidentified malware:

HELO: 77-72-3-56.hosted-at.kloud.co.uk
Sending IP: 77.72.3.56
From: Michele Kester <info17@ngyusa.com>
Reply-To: Michele Kester <biz@gurytour.ro>
Subject: Request for prices and lead time
Attachment: Order Specification.zip (contains "Order Specification.exe")

Intelligence

File Origin
# of uploads :
2
# of downloads :
84
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Sanesecurity.Malware.27686.AidExe.UNOFFICIAL
Create hunting rule

SecuriteInfo.com.PSW.Agent.BORA.UNOFFICIAL
Create hunting rule

Gathering data
Threat name:
Win32.Trojan.Predator
Create hunting rule
Status:
Malicious
First seen:
2020-05-13 07:18:18 UTC
File Type:
PE (Exe)
Extracted files:
26
AV detection:
26 of 31 (83.87%)
Threat level:
  2/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=6uct2y6doxhohrj7gppqjxdw36vdkygdlo27czxieoeajy52gica._file
Verdict:
malicious
Label(s):
azorult
Create hunting rule
Similar samples:
00a49f22e550e2f27514cf11bc8aaf3e47be2899f65f519cde21e1e2120de981
AZORult
1d76e4bf41a1674e4459f76b2696e50a7e8330924654c7cfeee2f641357b87a8
AZORult
2f01b3651a057e695f79803f1f19402ee9be5c1b063e9e185735c004ea910a00
AZORult
7a4e07c526076baec37f32de53722c87aade90c4e44a31629468d94f68cf46e8
AZORult
7cd0f0947f0485f250747fe2e8eee845d912830239a949ac721335824ee03365
AZORult
996c8fc0d84978d5827249e3573f0002535a18f0e317f31d244049bd58d74ee0
AZORult
9aece3982e025fc7385d1a971357a7857d0afdc3e5a1a550a497a47592c1b821
AZORult
a6a0f81b3e9ccf1b80fab7a213fc9ac33e396da4116af57360bff1d99621ae10
AZORult
b8cedaeefb46ff748af412d63d33b2d508966d4e33fd88efc592072b64017f5c
AZORult
f2dcf747bef15584ddd0242430a2374ef9b3b3b542b25cfd75589ec2d3dc66d6
AZORult
+ 1'178 additional samples on MalwareBazaar
Result
Malware family:
azorult
Create hunting rule
Score:
  10/10
Tags:
family:azorult infostealer trojan
Link:
https://tria.ge/reports/201109-4azpzc2nqj/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of FindShellTrayWindow
Suspicious use of SendNotifyMessage
Suspicious use of WriteProcessMemory
Suspicious use of SetThreadContext
Azorult
Malware Config
C2 Extraction:
http://217.160.170.24/index.php
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AZORult

zip 2dd59713bdfc82e98cb5dd6cff53b44006e5e110d13dc71ec779590b03da2d68

AZORult

Executable exe f5053d63c375cee3c53f33df04dc76dfaa3560c35bb5f166e8238804e3ba3204

(this sample)

  
Dropped by
MD5 2fd7671070753cffb4568f92c2e5dea2
  
Delivery method
Distributed via e-mail attachment
  
Dropped by
SHA256 2dd59713bdfc82e98cb5dd6cff53b44006e5e110d13dc71ec779590b03da2d68

Comments