MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 10fed6bb7e0d98d4c39fecce52838efecad2e6d836ceabaf40b438e6790e8abf. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

AZORult

Vendor detections: 11

Intelligence 11 IOCs YARA 4 File information Comments

SHA256 hash:	10fed6bb7e0d98d4c39fecce52838efecad2e6d836ceabaf40b438e6790e8abf
SHA3-384 hash:	2b53d77b30186e0626f74be4e734da635968548cb42d424c956e6cbf13da289865c6c9b7ca240b966e2431e9f869e253
SHA1 hash:	ffb37c91976a5b80bb93e25c887d97352c551ad4
MD5 hash:	583791881daeb3ac8d2739b0a728ac99
humanhash:	romeo-three-ten-item
File name:	583791881daeb3ac8d2739b0a728ac99.exe
Download:	download sample
Signature	AZORult Create hunting rule
File size:	708'096 bytes
First seen:	2022-02-11 07:24:13 UTC
Last seen:	2022-02-11 08:38:09 UTC
File type:	exe
MIME type:	application/x-dosexec
imphash	f34d5f2d4577ed6d9ceec516c1f5a744 (48'744 x AgentTesla, 19'608 x Formbook, 12'242 x SnakeKeylogger)
ssdeep	12288:97cQQMVHcbyrX3G8mw51WPd8cfyclc32NSa17GLAgha3GBP9Vh4XVMtGG:97YAsyD3G8mfPaMLl16L1hZGG
Threatray	4'542 similar samples on MalwareBazaar
TLSH	T14CE4E0AD766035DFC967C67ACAA86C24AA6070B7530FA347801350FA9A5DAD3CF105F3
File icon (PE):
dhash icon	b3b3333969693b3b (69 x Formbook, 63 x AgentTesla, 26 x Loki)
Reporter	abuse_ch
Tags:	AZORult exe

Intelligence

File Origin

# of uploads :

# of downloads :

392

Origin country :

n/a

Vendor Threat Intelligence

Detection:

Azorult

Link:

https://www.capesandbox.com/analysis/240854/

Detection(s):

SecuriteInfo.com.Variant.Bulz.680788.7154.24316.UNOFFICIAL

Result

Verdict:

Malware

Maliciousness:

Behaviour

Creating a window

DNS request

Unauthorized injection to a recently created process

Creating a file

Сreating synchronization primitives

Sending an HTTP POST request

Creating a file in the %temp% subdirectories

Reading critical registry keys

Stealing user critical data

Verdict:

Suspicious

Threat level:

5/10

Confidence:

100%

Tags:

obfuscated packed

Link:

https://www.filescan.io/uploads/62060f54289e2f3e4fc13d6c/reports/b0ae97c4-0c8b-49a1-bfa1-606c26542311/overview

Result

Verdict:

MALICIOUS

Details

Windows PE Executable

Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.

Malware family:

AZORult

Verdict:

Malicious

Link:

https://analyze.intezer.com/analyses/511da909-7f47-4f9d-b473-0d88927643f2

Result

Threat name:

Azorult

Detection:

malicious

Classification:

phis.troj.spyw.evad

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/938331

Signature

.NET source code contains potential unpacker

Antivirus detection for URL or domain

C2 URLs / IPs found in malware configuration

Found malware configuration

Found many strings related to Crypto-Wallets (likely being stolen)

Machine Learning detection for sample

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Tries to harvest and steal Bitcoin Wallet information

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal ftp login credentials

Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)

Tries to steal Crypto Currency Wallets

Tries to steal Instant Messenger accounts or passwords

Tries to steal Mail credentials (via file / registry access)

Yara detected AntiVM3

Yara detected Azorult

Yara detected Azorult Info Stealer

Behaviour

Behavior Graph:

Download SVG

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/10fed6bb7e0d98d4c39fecce52838efecad2e6d836ceabaf40b438e6790e8abf/

Threat name:

ByteCode-MSIL.Trojan.AgentTesla

Status:

Malicious

First seen:

2022-02-11 07:25:17 UTC

File Type:

PE (.Net Exe)

Extracted files:

AV detection:

18 of 28 (64.29%)

Threat level:

5/5

Verdict:

malicious

Label(s):

azorult

Result

Malware family:

azorult

Score:

10/10

Tags:

family:azorult collection discovery infostealer spyware stealer suricata trojan

Link:

https://tria.ge/reports/220211-h8zxlaeacp/

Behaviour

Checks processor information in registry

Modifies data under HKEY_USERS

Suspicious behavior: EnumeratesProcesses

Suspicious use of WriteProcessMemory

outlook_office_path

outlook_win_path

Drops file in Windows directory

Suspicious use of SetThreadContext

Accesses Microsoft Outlook profiles

Accesses cryptocurrency files/wallets, possible credential harvesting

Checks installed software on the system

Loads dropped DLL

Reads data files stored by FTP clients

Reads local data of messenger clients

Reads user/profile data of local email clients

Reads user/profile data of web browsers

Azorult

suricata: ET MALWARE AZORult v3.3 Server Response M2

suricata: ET MALWARE Win32/AZORult V3.3 Client Checkin M14

suricata: ET MALWARE Win32/AZORult V3.3 Client Checkin M5

Malware Config

C2 Extraction:

http://australiadish.bar/kendrick/index.php

Unpacked files

SH256 hash:

658c80f34df29800e29a4112d11cda1f861c5622cff223d43c026ee191473fc0

MD5 hash:

024c4790ae1fee2b1280f5b26da2bc6b

SHA1 hash:

e9e34165a3ffaad39aaec159387b333f3cff378a

Detections:

win_azorult_g1

win_azorult_auto

Link:

https://www.unpac.me/results/6e04f78c-3a9b-4be5-bcae-8a094f10f032/

Parent samples :

3ca1b9b8c365e7329e540d4e84320f0bf61e50a4bab5be54460d0c3e2f320ce1
fd5e6989ff1e8e4ef24bbb2b67018ef8adbdf0da5d489cd142fd8e1a033ce92e
10fed6bb7e0d98d4c39fecce52838efecad2e6d836ceabaf40b438e6790e8abf
d8c4fb5e1c854c9362c4129efbaa6b72435b8e93df66fd418f288650d360ff22
fb253ba653005c97ec369d37d3ef234e85989984c77296bc8f763b53cbb07ab9
f188d2c47c9f395e6063a2fe69edf5830c4d520e11f21421a1814d3202503c45
85e16c4fe21b79d748d246527b80cacb62c90b75f331e774d7cef90d3f3764f5
5c52d01a13034d617c28365f534c392ec264c3d755dc36ff188082081af05688

SH256 hash:

f365b92b11041eed57b6f7534e83e04167fce1cfacc570e79335292f3c0ea8aa

MD5 hash:

9147a2ef317fe384182d1281e5af8110

SHA1 hash:

bbe360e6eca29a32e1f787e1416ddad4d35dcf1a

Link:

https://www.unpac.me/results/6e04f78c-3a9b-4be5-bcae-8a094f10f032/

SH256 hash:

3210d4317871b7b77783288b021bcee923dbeac8eb2358052d4442c5ba3052a5

MD5 hash:

5c2ea5a25e4fe0d863e09768ae095c5d

SHA1 hash:

67974b17f76519f288ea74f73a3af0347cfd0ace

Link:

https://www.unpac.me/results/6e04f78c-3a9b-4be5-bcae-8a094f10f032/

SH256 hash:

e6ea1be8b28b68e73b5e4df82ebb633dc1b36a280418c23f25ed223cecfbfbb7

MD5 hash:

6be2c46a5949677900b89e91ea3071d1

SHA1 hash:

5d6d3727999ea0cf804ff1f102ca47b496382c66

Link:

https://www.unpac.me/results/6e04f78c-3a9b-4be5-bcae-8a094f10f032/

SH256 hash:

10fed6bb7e0d98d4c39fecce52838efecad2e6d836ceabaf40b438e6790e8abf

MD5 hash:

583791881daeb3ac8d2739b0a728ac99

SHA1 hash:

ffb37c91976a5b80bb93e25c887d97352c551ad4

Link:

https://www.unpac.me/results/6e04f78c-3a9b-4be5-bcae-8a094f10f032/

Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	exec_macros Create hunting rule
Author:	ddvvmmzz
Description:	exec macros

Rule name:	obfuscate_macros Create hunting rule
Author:	ddvvmmzz
Description:	obfuscate macros

Rule name:	pe_imphash Create hunting rule

Rule name:	Skystars_Malware_Imphash Create hunting rule
Author:	Skystars LightDefender
Description:	imphash

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

AZORult

exe 10fed6bb7e0d98d4c39fecce52838efecad2e6d836ceabaf40b438e6790e8abf

(this sample)

Cape

https://www.capesandbox.com/analysis/240854/

URLhaus

https://urlhaus.abuse.ch/url/2038758/

Delivery method

Distributed via web download

Comments

Login required

You need to login to in order to write a comment. Login with your abuse.ch account.

No comments found for this malware sample