MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 0057fefb89c07b006dab5e9950749f171e7fa84a82427eb752e8f2345b2c6f40. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

AZORult

Vendor detections: 10

Intelligence 10 IOCs YARA 1 File information Comments

SHA256 hash:	0057fefb89c07b006dab5e9950749f171e7fa84a82427eb752e8f2345b2c6f40
SHA3-384 hash:	ce52d85fa2da3df529b843d9e4415f35c1be032d5e1c42982807d29aaba30fcc58c644ba279482307c0fd19f9b2da27f
SHA1 hash:	a2de6a784c20e674cf659c0d48e30ef47327027e
MD5 hash:	7f35e1c42c7df0fdf57518c0e446b179
humanhash:	hydrogen-pasta-mike-ceiling
File name:	PO No1_00629518507.exe
Download:	download sample
Signature	AZORult Create hunting rule
File size:	727'040 bytes
First seen:	2020-10-13 06:03:58 UTC
Last seen:	2020-10-13 07:09:04 UTC
File type:	exe
MIME type:	application/x-dosexec
imphash	f34d5f2d4577ed6d9ceec516c1f5a744 (48'660 x AgentTesla, 19'469 x Formbook, 12'208 x SnakeKeylogger)
ssdeep	12288:N76Ox5PzsciWfDvZ1IVNk4F4ZD/lt2GwK1WLinGxtjlQYhi/IWTguiaTI5:Jx5XiW7ZKVN1FkD/72GwK1Oi0QYhxWEh
Threatray	321 similar samples on MalwareBazaar
TLSH	D8F4D0F932682F5FC5BE2DF25012058043F6265B70F9E6E86DC760EE49F9F8519102AB
Reporter	abuse_ch
Tags:	AZORult exe

abuse_ch

Malspam distributing unidentified malware:

HELO: server.devbox12.com
Sending IP: 162.249.2.44
From: CAO DUONG CO. LTD <narong@bpsiiw.com>
Reply-To: CAO DUONG CO. LTD <ricknicolas.aol@hotmail.com>
Subject: New Purchase Order - PO#8858ZEFA67688 to your company for the scope of supply
Attachment: PO No1_00629518507.rar (contains "PO No1_00629518507.exe")

Intelligence

File Origin

# of uploads :

# of downloads :

175

Origin country :

n/a

Vendor Threat Intelligence

Detection:

n/a

Link:

https://www.capesandbox.com/analysis/70280/

Detection(s):

SecuriteInfo.com.Trojan.PWS.Stealer.26517.26719.25571.UNOFFICIAL

Result

Verdict:

Malware

Maliciousness:

Behaviour

Creating a window

Sending a UDP request

Running batch commands

Creating a process with a hidden window

Launching a process

Result

Threat name:

AZORult

Detection:

malicious

Classification:

phis.spyw.evad

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/489229

Signature

.NET source code contains potential unpacker

Binary contains a suspicious time stamp

Detected AZORult Info Stealer

Found many strings related to Crypto-Wallets (likely being stolen)

Injects a PE file into a foreign processes

Machine Learning detection for sample

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Tries to harvest and steal Bitcoin Wallet information

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal ftp login credentials

Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)

Tries to steal Crypto Currency Wallets

Tries to steal Instant Messenger accounts or passwords

Tries to steal Mail credentials (via file access)

Yara detected AntiVM_3

Yara detected Azorult

Yara detected Azorult Info Stealer

Behaviour

Behavior Graph:

Download SVG

Detection:

azorult

Link:

https://mwdb.cert.pl/sample/0057fefb89c07b006dab5e9950749f171e7fa84a82427eb752e8f2345b2c6f40/

Threat name:

ByteCode-MSIL.Spyware.Noon

Status:

Malicious

First seen:

2020-10-12 16:17:43 UTC

AV detection:

22 of 29 (75.86%)

Threat level:

2/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=abl7564jyb5qa3nll2mva5e7c4ph7kckqjbh5n2s5dzdiwzmn5aa._file

Verdict:

malicious

Label(s):

azorult

Result

Malware family:

azorult

Score:

10/10

Tags:

spyware discovery trojan infostealer family:azorult

Link:

https://tria.ge/reports/201013-a2wpk5817a/

Behaviour

Checks processor information in registry

Delays execution with timeout.exe

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

Suspicious use of SetThreadContext

Accesses cryptocurrency files/wallets, possible credential harvesting

Checks installed software on the system

JavaScript code in executable

Deletes itself

Loads dropped DLL

Reads data files stored by FTP clients

Reads user/profile data of local email clients

Reads user/profile data of web browsers

Azorult

Malware Config

C2 Extraction:

http://etrad3r.com/3.3/index.php

Unpacked files

SH256 hash:

0057fefb89c07b006dab5e9950749f171e7fa84a82427eb752e8f2345b2c6f40

MD5 hash:

7f35e1c42c7df0fdf57518c0e446b179

SHA1 hash:

a2de6a784c20e674cf659c0d48e30ef47327027e

Link:

https://www.unpac.me/results/486dc50e-99f6-43eb-8ce4-0bdddc90bb4d/

SH256 hash:

bc617cfd5170b448e3ca2d529c71a70ad7b7295ec272192edd95fdba8e29bd64

MD5 hash:

f9a74dec28e23f9f0adcd4d1906ea8e9

SHA1 hash:

0c2b98627cc4270222bbbbb32181209c94be599d

Link:

https://www.unpac.me/results/486dc50e-99f6-43eb-8ce4-0bdddc90bb4d/

SH256 hash:

607f04646c9f16f7c23fa69d4b8f660fc7c44d40e4f73a0c70a2b315debdaa8b

MD5 hash:

a90baadadf904455325f7bc787185c7b

SHA1 hash:

7d833bb819d638008c98be469b05db2feaf201cd

Link:

https://www.unpac.me/results/486dc50e-99f6-43eb-8ce4-0bdddc90bb4d/

SH256 hash:

c4599224eca8dc90df9fc3c46ec19b6c131f7c7d4f73c0f1dc189d172dc70bab

MD5 hash:

12e1bbc50b9decd3e0f9257900ced656

SHA1 hash:

b3c08e3b81916425ddca9e9182b69856d4643b38

Detections:

win_azorult_g1

win_azorult_auto

Link:

https://www.unpac.me/results/486dc50e-99f6-43eb-8ce4-0bdddc90bb4d/

Parent samples :

b5037af6dcdc7dbbc9daf11c935cf5a57b9e7ed4290ffbf2de3aefc5a05fe85d
0057fefb89c07b006dab5e9950749f171e7fa84a82427eb752e8f2345b2c6f40

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Eldorado

Score:

0.90

Link:

https://yomi.yoroi.company/submissions/0057fefb89c07b006dab5e9950749f171e7fa84a82427eb752e8f2345b2c6f40

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.