MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 303c056f4b7b321431d706e01822da96149f3c5490cd7a2573eb5e6ec2f7e304. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

AZORult

Vendor detections: 9

Intelligence 9 IOCs YARA 5 File information Comments

SHA256 hash:	303c056f4b7b321431d706e01822da96149f3c5490cd7a2573eb5e6ec2f7e304
SHA3-384 hash:	8e6b1bd831db1832c7bda37ee36bdc0511b919f8a46477a21772ebcc66334c2359b2ec8a63af9cb392fb10805eab6971
SHA1 hash:	e9bc5e3efb490dfc21913ca30baea8919b230c0b
MD5 hash:	db6f7e2d343a85be4d2b486cc1be84be
humanhash:	kentucky-lamp-triple-lion
File name:	Our Ref SARS0928388128 Letter of Demand.pdf.exe
Download:	download sample
Signature	AZORult Create hunting rule
File size:	249'856 bytes
First seen:	2021-01-12 18:03:16 UTC
Last seen:	Never
File type:	exe
MIME type:	application/x-dosexec
imphash	1c111df02e2fb1f8eb1d52bfc842bac4 (8 x AZORult)
ssdeep	6144:GLSujxU6Fg+scHwtpJM4Mt5Tks9zk90Lw:GmujuDqwHMPvE
Threatray	915 similar samples on MalwareBazaar
TLSH	0534E741F244DA72E8870FB3997BCDB1412ABE395578871E314E77295BF338200B6E5A
Reporter	abuse_ch
Tags:	AZORult exe SARS

abuse_ch

Malspam distributing AZORult:

HELO: server.hello-africa.biz
Sending IP: 162.249.127.63
From: noreply@sars.gov.za
Subject: Urgent: SARS Letter of demand. COURT SUMMONS Imminent
Attachment: Our Ref SARS0928388128 Letter of Demand.pdf.gz (contains "Our Ref SARS0928388128 Letter of Demand.pdf.exe")

AZORult C2:
http://193.239.147.212/aztwo/index.php

Intelligence

File Origin

# of uploads :

# of downloads :

267

Origin country :

n/a

Vendor Threat Intelligence

Malware family:

n/a

ID:

File name:

Our Ref SARS0928388128 Letter of Demand.pdf.exe

Verdict:

No threats detected

Analysis date:

2021-01-12 18:58:59 UTC

Tags:

n/a

Link:

https://app.any.run/tasks/8ffe89d9-e1b1-4c39-afbc-7776659d877b

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

Detection:

Azorult

Link:

https://www.capesandbox.com/analysis/111576/

Detection(s):

SecuriteInfo.com.Variant.Graftor.752414.UNOFFICIAL

Result

Verdict:

Malware

Maliciousness:

Behaviour

Creating a window

Sending a UDP request

Result

Threat name:

AZORult

Detection:

malicious

Classification:

phis.spyw.evad

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/579326

Signature

Antivirus / Scanner detection for submitted sample

Binary contains a suspicious time stamp

Detected AZORult Info Stealer

Detected unpacking (changes PE section rights)

Found many strings related to Crypto-Wallets (likely being stolen)

Hides threads from debuggers

Initial sample is a PE file and has a suspicious name

Machine Learning detection for sample

Malicious sample detected (through community Yara rule)

Maps a DLL or memory area into another process

Multi AV Scanner detection for domain / URL

Multi AV Scanner detection for submitted file

Sigma detected: Suspicious Double Extension

Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)

Tries to harvest and steal Bitcoin Wallet information

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal ftp login credentials

Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)

Tries to steal Crypto Currency Wallets

Tries to steal Instant Messenger accounts or passwords

Tries to steal Mail credentials (via file access)

Uses an obfuscated file name to hide its real file extension (double extension)

Yara detected Azorult

Yara detected Azorult Info Stealer

Behaviour

Behavior Graph:

Download SVG

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/303c056f4b7b321431d706e01822da96149f3c5490cd7a2573eb5e6ec2f7e304/

Threat name:

Win32.Trojan.Graftor

Status:

Malicious

First seen:

2021-01-12 08:42:10 UTC

AV detection:

15 of 29 (51.72%)

Threat level:

5/5

Detection(s):

Malicious file

Link:

https://check.spamhaus.org/check/?searchterm=ga6ak32lpmzbimoxa3qbqiw2sykj6pcusdgxujlt5npg5qxx4mca._file

Verdict:

malicious

Label(s):

azorult

Result

Malware family:

n/a

Score:

1/10

Tags:

n/a

Link:

https://tria.ge/reports/210112-eklkp2dqqx/

Behaviour

Suspicious use of SetWindowsHookEx

Unpacked files

SH256 hash:

303c056f4b7b321431d706e01822da96149f3c5490cd7a2573eb5e6ec2f7e304

MD5 hash:

db6f7e2d343a85be4d2b486cc1be84be

SHA1 hash:

e9bc5e3efb490dfc21913ca30baea8919b230c0b

Link:

https://www.unpac.me/results/1c4a0050-01a4-460a-bd75-3f248ed1126b/

SH256 hash:

561dfd47a86bf03e89bae2835797b8386b2aba08f54bb06bc24a93b0baf8b996

MD5 hash:

6e532485bf1ef29762e2a772cb60f15f

SHA1 hash:

29c0b99449500f5cef1a3b33cc03383b8989eb56

Detections:

win_azorult_g1

win_azorult_auto

Link:

https://www.unpac.me/results/1c4a0050-01a4-460a-bd75-3f248ed1126b/

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/303c056f4b7b321431d706e01822da96149f3c5490cd7a2573eb5e6ec2f7e304

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	Steam_stealer_bin_mem Create hunting rule
Author:	James_inthe_box
Description:	Steam in files like avemaria

Rule name:	Telegram_stealer_bin_mem Create hunting rule
Author:	James_inthe_box
Description:	Telegram in files like avemaria

Rule name:	Trojan_W32_Gh0stMiancha_1_0_0 Create hunting rule

Rule name:	win_azorult_auto Create hunting rule
Author:	Felix Bilstein - yara-signator at cocacoding dot com
Description:	autogenerated rule brought to you by yara-signator