MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 36659906eb6832c7e9e93050a0ed361a18da1498c9a40eb85f2b7db7aba378b5. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AZORult


Vendor detections: 6


Intelligence 6 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 36659906eb6832c7e9e93050a0ed361a18da1498c9a40eb85f2b7db7aba378b5
SHA3-384 hash: 82dbe3b3b67f87532e900e4f492360cd1feea91b3d8866a8d2f0d9661f18dfb87ca0712a2d931518ae1287013a228e98
SHA1 hash: 56d43312c886a98432315d44169bf5242999649d
MD5 hash: 0109240aa04ee1b991f0aedbb2423cd1
humanhash: robert-alabama-muppet-lithium
File name:36659906eb6832c7e9e93050a0ed361a18da1498c9a40eb85f2b7db7aba378b5
Download: download sample
Signature AZORult
Create hunting rule
File size:3'516'587 bytes
First seen:2020-11-13 15:14:21 UTC
Last seen:2024-07-24 13:01:53 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash 00be6e6c4f9e287672c8301b72bdabf3 (116 x RedLineStealer, 70 x AsyncRAT, 55 x AgentTesla)
ssdeep 98304:XJMnnOUHuyqZ99hI1G84UCxE75AR8SLB6DJV2:X25HvqZ5Io+CxE75SLIr2
Threatray 876 similar samples on MalwareBazaar
TLSH 53F51205D310A9F2F506353981A77982CD9FBF7450B69A06B2CA1B68DFAB4DEDF0C640
Reporter seifreed
Tags:AZORult

Intelligence

File Origin
# of uploads :
2
# of downloads :
164
Origin country :
n/a
Vendor Threat Intelligence
Result
Verdict:
Clean
Maliciousness:

Behaviour
Sending a UDP request
Creating a window
Searching for the window
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/36659906eb6832c7e9e93050a0ed361a18da1498c9a40eb85f2b7db7aba378b5/
Threat name:
Win32.Trojan.Chifrax
Create hunting rule
Status:
Malicious
First seen:
2020-11-13 15:15:18 UTC
AV detection:
11 of 29 (37.93%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=gzszsbxlnazmp2pjgbikb3jwdimnufeyzgsa5oc7fn63pk5dpc2q._file
Verdict:
malicious
Label(s):
azorult
Create hunting rule
Similar samples:
0fce4c62d03dc1076db031e5770d863591801ce25f18f2f516205b35be85e9b5
AZORult
1aca49752cef2bb58d097e0ac96963e32f14e4e6b1e6e24e11125d1e9ef54cf2
AZORult
23b916e5bb30f814e9819cf3499fe56820380b827b20f595022eabbd47267374
AZORult
3459d3a07659440f0e31b4b59a53a6ed78914d64a467cab3dcd05de1555c1488
AZORult
6ec6d3425cc3bdc664f5938119469a2947ad061dac33fafbd303998c9311a254
AZORult
70d86fc8d1247dcd26ed0927411614973d45216d676978f768e14cb16d362536
AZORult
70f8a912b0343b177f6c04ea6a642dd85f68044728e5481e86cfe8311ed86e21
AZORult
72146e890efa1de6ee90e445ceb11ad9dc3b053fa5e82757756a393ee4617a77
AZORult
d98190863e8f53c385de8531ac7e5e89dc61cdaf17df688614ded12c24c78d31
AZORult
f0b43b05479d8dde3603ef587da02925b703d7d5bc8332656ab9ca7f7e1554a4
AZORult
+ 866 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  1/10
Tags:
n/a
Link:
https://tria.ge/reports/201113-xwqaq2fsrn/
Behaviour
Suspicious behavior: GetForegroundWindowSpam
Unpacked files
SH256 hash:
36659906eb6832c7e9e93050a0ed361a18da1498c9a40eb85f2b7db7aba378b5
MD5 hash:
0109240aa04ee1b991f0aedbb2423cd1
SHA1 hash:
56d43312c886a98432315d44169bf5242999649d
Link:
https://www.unpac.me/results/9a344f21-6d6f-47d5-bdac-f83ab542aee2/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/36659906eb6832c7e9e93050a0ed361a18da1498c9a40eb85f2b7db7aba378b5

File information

The table below shows additional information about this malware sample such as delivery method and external references.

  
Delivery method
Other

Comments