MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 31e9a43165167b0ac009e15f3974b8c09dc9c51d64496efa4897b850c65948f3. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

AZORult

Vendor detections: 11

Intelligence 11 IOCs YARA 1 File information Comments

SHA256 hash:	31e9a43165167b0ac009e15f3974b8c09dc9c51d64496efa4897b850c65948f3
SHA3-384 hash:	87117c4904bccf87628900b6497eba97e55a4c0414f7869226dece5e37575bce145cb56fc0ee8f3354b9d698c59114ae
SHA1 hash:	333f7fd682b51c04aa249c37b7a67739ce7274c8
MD5 hash:	bb97cd98ed89164b956bfe47be4c091a
humanhash:	freddie-fanta-double-beer
File name:	CCMA Final Reminder Case CMS GAJB18471-21.DOC.exe
Download:	download sample
Signature	AZORult Create hunting rule
File size:	231'424 bytes
First seen:	2021-01-19 12:55:03 UTC
Last seen:	Never
File type:	exe
MIME type:	application/x-dosexec
imphash	6ed4f5f04d62b18d96b26d6db7c18840 (257 x SalatStealer, 78 x BitRAT, 42 x RedLineStealer)
ssdeep	3072:sAvEWwLyF/dkwFf5hgIe4pCenqiZJ+YbUW65FMI9gTMgzwxGBYkwk:MxLW2wNLIeqiZJ+SrgnNDwBY9
Threatray	595 similar samples on MalwareBazaar
TLSH	9134F12ED080AD1EF374393DCB65EBB98270D916EEC98353FA496A066D351984F70C83
Reporter	abuse_ch
Tags:	AZORult exe

abuse_ch

Malspam distributing AZORult:

HELO: freyzmarketing.com
Sending IP: 188.138.122.57
From: casemngtsys@ccma.org.za
Subject: URGENT - CCMA Final Reminder: CCMA Case GAJB18471-21 (GAJB) is Rescheduled for 'Arbitration' for Fri 29-January-2021 10:00
Attachment: CCMA Final Reminder Case CMS GAJB18471-21.DOC.gz (contains "CCMA Final Reminder Case CMS GAJB18471-21.DOC.exe")

AZORult C2:
http://193.239.147.212/azone/index.php

Intelligence

File Origin

# of uploads :

# of downloads :

300

Origin country :

n/a

Vendor Threat Intelligence

Malware family:

n/a

ID:

File name:

CCMA Final Reminder Case CMS GAJB18471-21.DOC.exe

Verdict:

Malicious activity

Analysis date:

2021-01-19 12:55:26 UTC

Tags:

trojan rat azorult stealer

Link:

https://app.any.run/tasks/a5c7a296-962c-4863-ab28-51adcac97c58

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

Detection:

Azorult

Link:

https://www.capesandbox.com/analysis/112880/

Detection(s):

PUA.Win.Packer.Upolyx-12

PUA.Win.Packer.Upx-4

Result

Verdict:

Malware

Maliciousness:

Behaviour

Sending an HTTP POST request

Creating a file in the %temp% subdirectories

Creating a file

Deleting a recently created file

Reading critical registry keys

Creating a window

Sending a UDP request

Running batch commands

Creating a process with a hidden window

Launching a process

Stealing user critical data

Result

Threat name:

AZORult

Detection:

malicious

Classification:

phis.spyw.evad

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/584983

Signature

Binary contains a suspicious time stamp

Detected AZORult Info Stealer

Found many strings related to Crypto-Wallets (likely being stolen)

Machine Learning detection for sample

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for domain / URL

Multi AV Scanner detection for submitted file

Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)

Tries to harvest and steal Bitcoin Wallet information

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal ftp login credentials

Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)

Tries to steal Crypto Currency Wallets

Tries to steal Instant Messenger accounts or passwords

Tries to steal Mail credentials (via file access)

Uses an obfuscated file name to hide its real file extension (double extension)

Yara detected Azorult

Yara detected Azorult Info Stealer

Behaviour

Behavior Graph:

Download SVG

Detection:

azorult

Link:

https://mwdb.cert.pl/sample/31e9a43165167b0ac009e15f3974b8c09dc9c51d64496efa4897b850c65948f3/

Threat name:

Win32.Trojan.Malrep

Status:

Malicious

First seen:

2021-01-19 07:48:01 UTC

AV detection:

20 of 28 (71.43%)

Threat level:

5/5

Detection(s):

Malicious file

Link:

https://check.spamhaus.org/check/?searchterm=ghu2imlfcz5qvqaj4fpts5fyyco4tri5mrew56sis64fbrszjdzq._file

Verdict:

malicious

Label(s):

azorult

Result

Malware family:

azorult

Score:

10/10

Tags:

family:azorult discovery infostealer spyware trojan upx

Link:

https://tria.ge/reports/210119-ve84qksyln/

Behaviour

Checks processor information in registry

Delays execution with timeout.exe

Suspicious behavior: EnumeratesProcesses

Suspicious use of WriteProcessMemory

Suspicious use of AdjustPrivilegeToken

Program crash

Accesses cryptocurrency files/wallets, possible credential harvesting

Checks installed software on the system

JavaScript code in executable

Deletes itself

Loads dropped DLL

Reads data files stored by FTP clients

Reads user/profile data of local email clients

Reads user/profile data of web browsers

UPX packed file

Azorult

Malware Config

C2 Extraction:

http://193.239.147.212/azone/index.php

Unpacked files

SH256 hash:

20aeb3a66fe8be352c23d5f9c9503ede09e20dfa467062698095216ecc8aeba8

MD5 hash:

3891152e19de2e7149ec197452ecf1ff

SHA1 hash:

ca2f3c4d07b6e3dbe1ebfb5a88e7ab96eed8d978

Detections:

win_azorult_g1

win_azorult_auto

Link:

https://www.unpac.me/results/fc7e5499-d65d-4eb2-a4cc-d6b2060da75a/

Parent samples :

84eed2d8d2c4b18c30ee556a96f780eacab4867c8edddad676161d205c6ee404
5db8b33a4069d4aaf14e604e99435ea1a23af599c98352ce06f93fa00fe7237a
31e9a43165167b0ac009e15f3974b8c09dc9c51d64496efa4897b850c65948f3

SH256 hash:

39873b9682ebca418e020fb7c4c3d325fc736eada8f0271f49defb3faf601a2a

MD5 hash:

29f794ff8674dbcf1d64fe8a723a293b

SHA1 hash:

751526d7db92b50b81649ecfc31082b08eeb1dcf

Link:

https://www.unpac.me/results/fc7e5499-d65d-4eb2-a4cc-d6b2060da75a/

SH256 hash:

31e9a43165167b0ac009e15f3974b8c09dc9c51d64496efa4897b850c65948f3

MD5 hash:

bb97cd98ed89164b956bfe47be4c091a

SHA1 hash:

333f7fd682b51c04aa249c37b7a67739ce7274c8

Link:

https://www.unpac.me/results/fc7e5499-d65d-4eb2-a4cc-d6b2060da75a/

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Suspicious File

Score:

0.34

Link:

https://yomi.yoroi.company/submissions/31e9a43165167b0ac009e15f3974b8c09dc9c51d64496efa4897b850c65948f3

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	suspicious_packer_section Create hunting rule
Author:	@j0sm1
Description:	The packer/protector section names/keywords
Reference:	http://www.hexacorn.com/blog/2012/10/14/random-stats-from-1-2m-samples-pe-section-names/