MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 20eb16150dc493901670bd428b72eaa88f8c575bded5d9df8cf174e70c4e2e2c. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AZORult


Vendor detections: 16


Intelligence 16 IOCs YARA 4 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 20eb16150dc493901670bd428b72eaa88f8c575bded5d9df8cf174e70c4e2e2c
SHA3-384 hash: 24937cdfc7ec4f717915b2e61cf8243044125874a9d3c1cd12416d01805c0440ecbe4c6e873af36ff32f04b89a983b9c
SHA1 hash: 989bb1370188e7de859b5d8d8b9e41f6e6e53bae
MD5 hash: 6312926cd48cff0cb0ab63a76d3e45f2
humanhash: alanine-carpet-alanine-pennsylvania
File name:DHL-119040 de recibo,pdf.exe
Download: download sample
Signature AZORult
Create hunting rule
File size:175'088 bytes
First seen:2022-09-24 07:49:23 UTC
Last seen:2022-09-24 09:06:42 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'742 x AgentTesla, 19'607 x Formbook, 12'242 x SnakeKeylogger)
ssdeep 3072:HFIJLYc0HyU1dy1eVhBTwXdHPrItwrq3EIBAm35pOFPjKy7wq:HFQpU1dke1EXdHPKw23EF
Threatray 76 similar samples on MalwareBazaar
TLSH T10504D08077A4894BCC2B9F3AA8CD85150738FC567E03D3A771C9B36D0E923DA2E55987
TrID 72.5% (.EXE) Generic CIL Executable (.NET, Mono, etc.) (73123/4/13)
10.4% (.EXE) Win64 Executable (generic) (10523/12/4)
6.5% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
4.4% (.EXE) Win32 Executable (generic) (4505/5/1)
2.0% (.EXE) OS/2 Executable (generic) (2029/13)
File icon (PE):PE icon
dhash icon d2e8ecb2b2a2b282 (106 x AgentTesla, 106 x Formbook, 24 x RedLineStealer)
Reporter abuse_ch
Tags:AZORult DHL ESP exe geo

Intelligence

File Origin
# of uploads :
2
# of downloads :
422
Origin country :
n/a
Vendor Threat Intelligence
Detection:
Azorult
Create hunting rule
Link:
https://www.capesandbox.com/analysis/312804/
Detection(s):
SecuriteInfo.com.Trojan.PackedNET.1584.14108.11367.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Launching a process
Creating a file
Сreating synchronization primitives
DNS request
Sending an HTTP POST request
Creating a file in the %temp% subdirectories
Reading critical registry keys
Running batch commands
Creating a process with a hidden window
Sending a custom TCP request
Stealing user critical data
Unauthorized injection to a system process
Verdict:
Suspicious
Threat level:
  5/10
Confidence:
100%
Tags:
obfuscated overlay packed
Link:
https://www.filescan.io/uploads/632eb6ec73bbffe3a785f254/reports/0581375a-ffa9-4fde-8099-073c49fdeaed/overview
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
AZORult
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/4fcf548c-29af-4ca4-b467-9b984f68bcf3
Result
Threat name:
Azorult
Create hunting rule
Detection:
malicious
Classification:
phis.troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1076386
Signature
.NET source code contains potential unpacker
Allocates memory in foreign processes
Antivirus detection for URL or domain
C2 URLs / IPs found in malware configuration
Contains functionality to check if a debugger is running (CheckRemoteDebuggerPresent)
DLL side loading technique detected
Found many strings related to Crypto-Wallets (likely being stolen)
Injects a PE file into a foreign processes
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for domain / URL
Multi AV Scanner detection for submitted file
Snort IDS alert for network traffic
Tries to harvest and steal Bitcoin Wallet information
Tries to harvest and steal browser information (history, passwords, etc)
Tries to harvest and steal ftp login credentials
Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)
Tries to steal Crypto Currency Wallets
Tries to steal Instant Messenger accounts or passwords
Tries to steal Mail credentials (via file / registry access)
Writes to foreign memory regions
Yara detected Azorult
Yara detected Azorult Info Stealer
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 708924 Sample: DHL-119040 de recibo,pdf.exe Startdate: 24/09/2022 Architecture: WINDOWS Score: 100 37 Snort IDS alert for network traffic 2->37 39 Multi AV Scanner detection for domain / URL 2->39 41 Malicious sample detected (through community Yara rule) 2->41 43 9 other signatures 2->43 8 DHL-119040 de recibo,pdf.exe 1 2->8         started        process3 file4 23 C:\Users\...\DHL-119040 de recibo,pdf.exe.log, ASCII 8->23 dropped 45 Writes to foreign memory regions 8->45 47 Allocates memory in foreign processes 8->47 49 Injects a PE file into a foreign processes 8->49 12 aspnet_compiler.exe 63 8->12         started        signatures5 process6 dnsIp7 33 kngpdrp.shop 188.114.97.3, 49698, 49699, 80 CLOUDFLARENETUS European Union 12->33 35 192.168.2.1 unknown unknown 12->35 25 C:\Users\user\AppData\Local\Temp\...\nss3.dll, PE32 12->25 dropped 27 C:\Users\user\AppData\Local\...\mozglue.dll, PE32 12->27 dropped 29 C:\Users\user\AppData\...\vcruntime140.dll, PE32 12->29 dropped 31 45 other files (none is malicious) 12->31 dropped 51 Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc) 12->51 53 Tries to steal Instant Messenger accounts or passwords 12->53 55 Tries to steal Mail credentials (via file / registry access) 12->55 57 5 other signatures 12->57 17 cmd.exe 1 12->17         started        file8 signatures9 process10 process11 19 conhost.exe 17->19         started        21 timeout.exe 1 17->21         started       
Detection:
azorult
Create hunting rule
Link:
https://mwdb.cert.pl/sample/20eb16150dc493901670bd428b72eaa88f8c575bded5d9df8cf174e70c4e2e2c/
Threat name:
Win32.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2022-09-24 07:50:10 UTC
File Type:
PE (.Net Exe)
Extracted files:
5
AV detection:
18 of 26 (69.23%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=edvrmfinysjzaftqxvbiw4xkvchyyv2333k5tx4m6f2oodcofywa._file
Verdict:
malicious
Label(s):
formbook
Create hunting rule
Similar samples:
0055c0240aa6da781fdbe57182ebe6d1e69c9d9a1eb401cdab0ad574e9191c17
AZORult
1c8cfb9a1902b2601d5819eb87f4dfe03c51bd99b6e6beecb95d7f749d7ea088
AZORult
2a854f928b9f620db24aa73c1e175e8e064e2bcc56a5b961c0a3e30de6c1ceb6
AZORult
3d4bcb3525d58d2270133e0349f8cc3463a2c5b151e8cc7b1580806c6e86fbf8
AZORult
5313fc45b561f9f19cd4085a2ee687c10d41762994e43eb33e0c94e78c1d7652
AZORult
8a335420005debd5b4e09fe983d88d18c6f62e88e504776f3f23491d0b339018
AZORult
c35cd99a9bd4f1a8289d3bc98bf59a57ac7816ec16de668d37cf4ee747ab7c35
AZORult
da98cbe42ca0067f1c8646f6cb039fb77e20ec5073d247376db2ee07307d528c
AZORult
eea2a192c80e6d01051766e7f06213f6870d45c4be44f47ba09f7ef51e1581f1
AZORult
f2c121b416fc3e961b271733a3e269b1227d0579676c60da524b80c15dbf33ac
AZORult
+ 66 additional samples on MalwareBazaar
Result
Malware family:
azorult
Create hunting rule
Score:
  10/10
Tags:
family:azorult collection infostealer spyware stealer trojan
Link:
https://tria.ge/reports/220924-jpac9scbck/
Behaviour
Checks processor information in registry
Delays execution with timeout.exe
Suspicious behavior: EnumeratesProcesses
Suspicious use of WriteProcessMemory
outlook_office_path
outlook_win_path
Suspicious use of SetThreadContext
Accesses Microsoft Outlook profiles
Accesses cryptocurrency files/wallets, possible credential harvesting
Loads dropped DLL
Reads local data of messenger clients
Azorult
Malware Config
C2 Extraction:
http://kngpdrp.shop/PL341/index.php
Verdict:
Suspicious
Tags:
n/a
YARA:
n/a
Link:
https://app.threat.zone/submission/3c7bd1d4-9f82-4a61-97a7-a8b8b9a67972
Unpacked files
SH256 hash:
d861e1e99b04f2f8a8d47b5e549f406fb24b2bf1eca14fdbb22176bdb6576134
MD5 hash:
127cb8e0065b6a3fe1cfe61125a96fdd
SHA1 hash:
c4905e72903709381ecf7bcef63e58c044d738da
Detections:
win_azorult_auto
Create hunting rule
win_azorult_g1
Create hunting rule
Link:
https://www.unpac.me/results/452f1363-2960-4474-8769-f298ffa551df/
Parent samples :
20eb16150dc493901670bd428b72eaa88f8c575bded5d9df8cf174e70c4e2e2c
8a07e0548084f0e3f3334cdf0c8d0b3e1c57e0b33c7df3159d6da4d11931f9ce
13c9ec087b8177e95285fd90ddffb04a3858dbf7316bb1bddc0ab32e38f1c806
295a65a8d806b7cb84d7b28e005b823aa5252501ac639293ebe330e0e151359d
SH256 hash:
0c5a04bfcc5d7f641d029d552d6b52c62cdf495134e32c0057efcd834413005a
MD5 hash:
3a99688ce90ff33fd1bb5420395fdaec
SHA1 hash:
ab495ae5b75f186f49656667f1ffab0f92921d4b
Link:
https://www.unpac.me/results/452f1363-2960-4474-8769-f298ffa551df/
SH256 hash:
817dbea9010a3ed4a58b0e538e27eaa1491144c446de2f6d290e07b97b8800fa
MD5 hash:
2324d4bfbe8b6f8e1950ee94c6253706
SHA1 hash:
88d8d1f946613c877261d281e0363eb5665dc544
Link:
https://www.unpac.me/results/452f1363-2960-4474-8769-f298ffa551df/
SH256 hash:
20eb16150dc493901670bd428b72eaa88f8c575bded5d9df8cf174e70c4e2e2c
MD5 hash:
6312926cd48cff0cb0ab63a76d3e45f2
SHA1 hash:
989bb1370188e7de859b5d8d8b9e41f6e6e53bae
Link:
https://www.unpac.me/results/452f1363-2960-4474-8769-f298ffa551df/
Malware family:
AZORult v3
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/20eb16150dc4/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/20eb16150dc493901670bd428b72eaa88f8c575bded5d9df8cf174e70c4e2e2c

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:INDICATOR_EXE_Packed_ConfuserEx
Create hunting rule
Author:ditekSHen
Description:Detects executables packed with ConfuserEx Mod
Rule name:pdb_YARAify
Create hunting rule
Author:@wowabiy314
Description:PDB
Rule name:pe_imphash
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AZORult

Executable exe 20eb16150dc493901670bd428b72eaa88f8c575bded5d9df8cf174e70c4e2e2c

(this sample)

  
Delivery method
Distributed via e-mail attachment
Cape
Cape
https://www.capesandbox.com/analysis/312804/

Comments