MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 06de75b87333ad16ff8f3a9d1729784ef6f5ac11076d0a5effa2c023e683bd98. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

AZORult

Vendor detections: 4

Intelligence 4 IOCs YARA File information Comments

SHA256 hash:	06de75b87333ad16ff8f3a9d1729784ef6f5ac11076d0a5effa2c023e683bd98
SHA3-384 hash:	fd3baccb119a111fb9b62a3b4561bd63606d233660882e16c126fdeebc01cad026d5fb578e32e75d3f91759ea80a09a9
SHA1 hash:	2d3b6a708caf9fc2885f39920e8c574764904837
MD5 hash:	8afe40feca71eab1b5504ac56ac09ca3
humanhash:	video-three-magnesium-zebra
File name:	anyisouthz.exe
Download:	download sample
Signature	AZORult Create hunting rule
File size:	870'400 bytes
First seen:	2020-04-01 10:16:41 UTC
Last seen:	Never
File type:	exe
MIME type:	application/x-dosexec
imphash	a17563c04d15b724e8cf090518294c73 (5 x Loki, 1 x AZORult, 1 x 404Keylogger)
ssdeep	12288:2KzVIr2VadKEcOhKj/EZhhxqhe4g1euWUeq5JmlJui6payQ39vjDRNl+HHA2NSZ:JmJdKKKjmhyVg1euXdmlJuja39L7luoZ
Threatray	286 similar samples on MalwareBazaar
TLSH	BC05C026F6E08473D1272A3C9D1BA7B4AC29FE101F2865666BF91C0CDF39681353A1D7
Reporter	oppimaniac
Tags:	AZORult

Intelligence

File Origin

# of uploads :

# of downloads :

102

Origin country :

n/a

Vendor Threat Intelligence

Detection(s):

PUA.Win.Adware.Slugin-6803969-0

PUA.Win.Adware.Slugin-6840354-0

Gathering data

Threat name:

Win32.Trojan.Injector

Status:

Malicious

First seen:

2020-04-01 06:20:49 UTC

AV detection:

29 of 31 (93.55%)

Threat level:

5/5

Detection(s):

Malicious file

Link:

https://check.spamhaus.org/check/?searchterm=a3phlodtgowrn74phkoroklyj33pllara5wquxx7ulachzudxwma._file

Verdict:

malicious

Label(s):

azorult

Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

AZORult

exe 06de75b87333ad16ff8f3a9d1729784ef6f5ac11076d0a5effa2c023e683bd98

(this sample)

URLhaus

https://urlhaus.abuse.ch/url/330283/

Delivery method

Distributed via web download

BLint

The following table provides more information about this file using BLint. BLint is a Binary Linter to check the security properties, and capabilities in executables.

Findings

ID	Title	Severity
CHECK_AUTHENTICODE	Missing Authenticode	high
CHECK_NX	Missing Non-Executable Memory Protection	critical
CHECK_PIE	Missing Position-Independent Executable (PIE) Protection	high

Reviews

ID	Capabilities	Evidence
COM_BASE_API	Can Download & Execute components	ole32.dll::CoCreateInstance ole32.dll::CreateStreamOnHGlobal
MULTIMEDIA_API	Can Play Multimedia	winmm.dll::mciGetErrorStringA winmm.dll::mciSendCommandA
WIN32_PROCESS_API	Can Create Process and Threads	kernel32.dll::VirtualAllocEx kernel32.dll::CloseHandle kernel32.dll::CreateThread
WIN_BASE_API	Uses Win Base API	kernel32.dll::LoadLibraryExA kernel32.dll::LoadLibraryA kernel32.dll::GetSystemInfo kernel32.dll::GetStartupInfoA kernel32.dll::GetDiskFreeSpaceA kernel32.dll::GetCommandLineA
WIN_BASE_EXEC_API	Can Execute other programs	kernel32.dll::WinExec
WIN_BASE_IO_API	Can Create Files	kernel32.dll::CreateFileA kernel32.dll::GetFileAttributesA kernel32.dll::FindFirstFileA version.dll::GetFileVersionInfoSizeA version.dll::GetFileVersionInfoA
WIN_BASE_USER_API	Retrieves Account Information	kernel32.dll::GetComputerNameA
WIN_REG_API	Can Manipulate Windows Registry	advapi32.dll::RegOpenKeyExA advapi32.dll::RegQueryValueExA
WIN_USER_API	Performs GUI Actions	user32.dll::ActivateKeyboardLayout user32.dll::CreateMenu user32.dll::FindWindowA user32.dll::PeekMessageA user32.dll::CreateWindowExA

Comments

Login required

You need to login to in order to write a comment. Login with your abuse.ch account.

No comments found for this malware sample