MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 38c77867b04ba02f9a57b5010e371a393a993dc3a216562a70c71a6b363b1648. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AZORult


Vendor detections: 10


Intelligence 10 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 38c77867b04ba02f9a57b5010e371a393a993dc3a216562a70c71a6b363b1648
SHA3-384 hash: e6ddcc85fddfcd89aa5d7207bfa9eea7832a94ab4d2ad0bb154d87518c5d9a9f97d3d4d401a1a197c355e9ecad5e42ac
SHA1 hash: a21f202d321adaf0b3e30b4b9ce3245e589e6219
MD5 hash: dffc776a0105b7015027c6bc01fac8d8
humanhash: mountain-india-muppet-muppet
File name:dffc776a0105b7015027c6bc01fac8d8.exe
Download: download sample
Signature AZORult
Create hunting rule
File size:396'288 bytes
First seen:2020-12-03 17:18:49 UTC
Last seen:2020-12-03 19:00:25 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'652 x AgentTesla, 19'463 x Formbook, 12'204 x SnakeKeylogger)
ssdeep 6144:joC+C3cNx6DMeqaEv6iOYvHaqtTBOyWyctN0HYD1v7E6l1cM4lTwBBJ:UC+C3cNI4paEfOyWrtiHG1oYnJ
Threatray 472 similar samples on MalwareBazaar
TLSH 3F84F13232467A9AEABA0FF0547021800EB57A3BA764D2CCBD85165E78F3701DF54DB6
Reporter abuse_ch
Tags:AZORult exe

Intelligence

File Origin
# of uploads :
2
# of downloads :
287
Origin country :
n/a
Vendor Threat Intelligence
Detection:
Azorult
Create hunting rule
Link:
https://www.capesandbox.com/analysis/106641/
Detection(s):
SecuriteInfo.com.Trojan.Inject4.6091.9258.26175.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Sending a UDP request
Creating a window
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Result
Threat name:
Azorult
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/554943
Signature
.NET source code contains potential unpacker
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for domain / URL
Multi AV Scanner detection for submitted file
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Uses dynamic DNS services
Yara detected AntiVM_3
Yara detected Azorult
Yara detected Azorult Info Stealer
Behaviour
Behavior Graph:
Download SVG
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/38c77867b04ba02f9a57b5010e371a393a993dc3a216562a70c71a6b363b1648/
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2020-12-03 17:19:07 UTC
AV detection:
19 of 29 (65.52%)
Threat level:
  5/5
Verdict:
malicious
Label(s):
azorult
Create hunting rule
Similar samples:
09b7bf15736eeb15efdae06322e1aa1e8f960d3264aa380ab0ba05a348aadca6
AZORult
272777668e4f5c8df52231c41b36280472e7ce8d01cee736af87f847265e2766
AZORult
31a4046b499a8ee12fc1695fcf05091a1a4072399b972080c3aa37a21b09d1cc
AZORult
55948fede55c398fce76d97b8316d5da6f958b08746a33f0cdaf4e016f0a1e15
AZORult
623d707cab5c5dc378a5100018e29f88949f4ea4be4b34cc2fc36e1612b68100
AZORult
7e3c713dd63b4620a6fe5c7c848726eca5e01918b7977561ec00f7d8f8f31cd8
AZORult
9d4101435d5c761e583b31dd48ddcd5bce7081ae2e290f04330e6c4dbf954c92
AZORult
9e196418dece3402ea9627106e6e246d5186392f25f8ada694598168481fb0bf
AZORult
bc7980d8d26972345c934f05a7f5f596b72957e06630c20a853b0c3146c5461c
AZORult
da37b9b8890fa84de87323c1599d96ca8aab10238d9d98bdb72853f2d445780f
AZORult
+ 462 additional samples on MalwareBazaar
Result
Malware family:
azorult
Create hunting rule
Score:
  10/10
Tags:
family:azorult infostealer trojan
Link:
https://tria.ge/reports/201203-zv2snfswce/
Behaviour
Suspicious use of WriteProcessMemory
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of SetThreadContext
Azorult
Malware Config
C2 Extraction:
http://195.245.112.115/index.php
Unpacked files
SH256 hash:
38c77867b04ba02f9a57b5010e371a393a993dc3a216562a70c71a6b363b1648
MD5 hash:
dffc776a0105b7015027c6bc01fac8d8
SHA1 hash:
a21f202d321adaf0b3e30b4b9ce3245e589e6219
Link:
https://www.unpac.me/results/9cf21a92-a248-42d7-9775-695776c83af7/
SH256 hash:
d959d08302ae9df9ba3e8bcd383bdc44b673b9218ead563db822ef526f9ae647
MD5 hash:
8c13e656cfbc3ffacce284e64b6830d9
SHA1 hash:
06401587cede8a9c17af9f168e21896665005509
Link:
https://www.unpac.me/results/9cf21a92-a248-42d7-9775-695776c83af7/
SH256 hash:
c88a66cbf00b12c88e2b970b8bc220e970e8465e56098ced24e97d42be901b94
MD5 hash:
a60401dc02ff4f3250a749965097e13f
SHA1 hash:
3f22d28fd765f831084cb972a8bd071e421c26a1
Link:
https://www.unpac.me/results/9cf21a92-a248-42d7-9775-695776c83af7/
SH256 hash:
c6131f431af7df135bb6cc3907df4f3966d2e3aef9dbb53437ff65b71b5c6edb
MD5 hash:
a53f97d38714540a105f78ece4bfd3fc
SHA1 hash:
90f52b5ec2e9714f2b438525875217caca1f6e53
Detections:
win_azorult_g1
Create hunting rule
win_azorult_auto
Create hunting rule
Link:
https://www.unpac.me/results/9cf21a92-a248-42d7-9775-695776c83af7/
Parent samples :
38c77867b04ba02f9a57b5010e371a393a993dc3a216562a70c71a6b363b1648
5822fa47a5eab9578ec51ee113a156f455c6c8f60ce80d084663c2f31fe25e91
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Kryptik
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/38c77867b04ba02f9a57b5010e371a393a993dc3a216562a70c71a6b363b1648

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

AZORult

Executable exe 38c77867b04ba02f9a57b5010e371a393a993dc3a216562a70c71a6b363b1648

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/886180/
  
Delivery method
Distributed via web download
Cape
Cape
https://www.capesandbox.com/analysis/106641/

Comments