MalwareBazaar Database
You are currently viewing the MalwareBazaar entry for SHA256 24ed16aa91766bd198e5d026082e7c19a16739a1defa14b0b9a3363be6155996. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.
Database Entry
AZORult
Vendor detections: 11
| SHA256 hash: | 24ed16aa91766bd198e5d026082e7c19a16739a1defa14b0b9a3363be6155996 |
|---|---|
| SHA3-384 hash: | bb391bd2be66caf401a5e731958af423686701e5740eea815f20301503069fb32f47e4bdcbd64d5d52ab1fe93213b04a |
| SHA1 hash: | 7cc4591b050474f221979ee1fb93e1a0482b20f1 |
| MD5 hash: | a79115f8510618e9098061aa5ca762fc |
| humanhash: | cola-six-thirteen-comet |
| File name: | Proforma invoice.exe |
| Download: | download sample |
| Signature | AZORult |
| File size: | 304'128 bytes |
| First seen: | 2021-02-21 18:12:16 UTC |
| Last seen: | Never |
| File type: |  exe |
| MIME type: | application/x-dosexec |
| imphash | f34d5f2d4577ed6d9ceec516c1f5a744 (48'740 x AgentTesla, 19'600 x Formbook, 12'241 x SnakeKeylogger) |
| ssdeep | 6144:9/7IKyWI+wK1/NAPtihxYldCwZz5uJzRnTDklBzk4:2KE9S/Na8svuJ1TDklBz |
| Threatray | 656 similar samples on MalwareBazaar |
| TLSH | 2B54122030A0631BC6A98FF26BB85484273699644192FF9E5C97B1E87775B020BD3F5B |
| Reporter |  abuse_ch |
| Tags: | AZORult exe |
abuse_ch
Malspam distributing AZORult:HELO: mail.globexdesign.com
Sending IP: 142.4.2.6
From: Ratna Fardilla <conact@shadmantents.com>
Reply-To: Ratna Fardilla <biz@eloquentcs.com>
Subject: Proforma invoice
Attachment: Proforma invoice.zip (contains "Proforma invoice.exe")
AZORult C2:
http://198.71.50.125/index.php
Intelligence
File Origin
# of uploads :
1
# of downloads :
305
Origin country :
n/a
Vendor Threat Intelligence
Detection:
Azorult
Result
Verdict:
Malware
Maliciousness:
Behaviour
Sending a UDP request
Creating a window
Unauthorized injection to a recently created process
Creating a file
Sending an HTTP POST request
Creating a file in the %temp% subdirectories
Deleting a recently created file
Reading critical registry keys
Stealing user critical data
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Result
Threat name:
AZORult
Detection:
malicious
Classification:
phis.spyw.evad
Score:
100 / 100
Signature
Binary contains a suspicious time stamp
Detected AZORult Info Stealer
Executable has a suspicious name (potential lure to open the executable)
Found many strings related to Crypto-Wallets (likely being stolen)
Initial sample is a PE file and has a suspicious name
Injects a PE file into a foreign processes
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for submitted file
Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)
Tries to harvest and steal browser information (history, passwords, etc)
Tries to harvest and steal ftp login credentials
Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)
Tries to steal Instant Messenger accounts or passwords
Tries to steal Mail credentials (via file access)
Yara detected Azorult
Yara detected Azorult Info Stealer
Behaviour
Behavior Graph:
Detection:
azorult
Threat name:
Win32.Trojan.AgentTesla
Status:
Malicious
First seen:
2021-02-21 15:39:19 UTC
AV detection:
16 of 28 (57.14%)
Threat level:
5/5
Detection(s):
Malicious file
Verdict:
malicious
Label(s):
azorult
Similar samples:
+ 646 additional samples on MalwareBazaar
Result
Malware family:
azorult
Score:
10/10
Tags:
family:azorult discovery infostealer spyware trojan
Behaviour
Checks processor information in registry
Suspicious behavior: EnumeratesProcesses
Suspicious use of WriteProcessMemory
Suspicious use of SetThreadContext
Checks installed software on the system
Loads dropped DLL
Reads data files stored by FTP clients
Reads user/profile data of local email clients
Reads user/profile data of web browsers
Azorult
Malware Config
C2 Extraction:
http://198.71.50.125/index.php
Unpacked files
SH256 hash:
e32832e4a355f5150a2853dd18c4b91672d6a4c73b41a66bf9cfea43db1a83b4
MD5 hash:
4c5b72f44bf4803c197cbdca09a10699
SHA1 hash:
9efdf69a81300b8b0dd10f57269ff87fa6820f82
SH256 hash:
29b0129860548407b607f21c780a867cb5ab49b04b0e7dafa2f61b0235ee3b92
MD5 hash:
4b5bc07209dd7ad55b0091930bfc7ee6
SHA1 hash:
1f12ff69c5f0356d18d71ade12132ff15c92d78f
Detections:
win_azorult_g1
win_azorult_auto
SH256 hash:
f0a09c48af16c079c37ad0914f18897976357981fe5ee6f556ab9f9f70b9a671
MD5 hash:
f984a71581f6da5732110be2a569a392
SHA1 hash:
10de05b6b35fc5dbc00c42d59a4b850bcaae01e6
SH256 hash:
24ed16aa91766bd198e5d026082e7c19a16739a1defa14b0b9a3363be6155996
MD5 hash:
a79115f8510618e9098061aa5ca762fc
SHA1 hash:
7cc4591b050474f221979ee1fb93e1a0482b20f1
Please note that we are no longer able to provide a coverage score for Virus Total.
File information
The table below shows additional information about this malware sample such as delivery method and external references.
Malspam
Delivery method
Distributed via e-mail attachment
Comments
Login required
You need to login to in order to write a comment. Login with your abuse.ch account.