MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 3acf3f2b79ad2c1b58d9331a3754ff8109b0998b5729aba2429103511fa3bd65. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AZORult


Vendor detections: 11


Intelligence 11 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 3acf3f2b79ad2c1b58d9331a3754ff8109b0998b5729aba2429103511fa3bd65
SHA3-384 hash: dc28e998b4079291ecc863603c9b4d9615cd9a900c60d647df00a60d84ecde7572c79e8a64d2a4b2f7c69f5c5b6a1557
SHA1 hash: 0e1c004e532d4a38b8ff818439682ab471ced6d1
MD5 hash: 5d86b7e57a49db2cd1c597b02c3deae4
humanhash: alanine-quebec-tennis-uncle
File name:DARWISH TRADING PROFILE copy.exe
Download: download sample
Signature AZORult
Create hunting rule
File size:809'472 bytes
First seen:2021-03-16 14:57:41 UTC
Last seen:2021-03-16 16:33:09 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'661 x AgentTesla, 19'474 x Formbook, 12'208 x SnakeKeylogger)
ssdeep 12288:Cp7erYuyKRGWpP4Y0aOwk3mlLn9QjTjrW3mx+qi9kqPq:tSKnp4Dwk3ULN3vqqC
Threatray 261 similar samples on MalwareBazaar
TLSH 1505CE15B754BFEAC1AD2F3A88272E5483E0C23BA232F69B6DD554C40361F858B2F517
Reporter madjack_red
Tags:AZORult

Intelligence

File Origin
# of uploads :
5
# of downloads :
220
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
DARWISH TRADING PROFILE copy.exe
Verdict:
Malicious activity
Analysis date:
2021-03-16 15:03:59 UTC
Tags:
trojan rat azorult stealer
Link:
https://app.any.run/tasks/b0aa87dc-2242-4ffd-837e-79948c8262c4

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection(s):
SecuriteInfo.com.Trojan.GenericKD.36510010.32169.8491.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
DNS request
Sending a custom TCP request
Sending a UDP request
Creating a window
Creating a file in the %temp% directory
Creating a process from a recently created file
Creating a file
Sending an HTTP POST request
Deleting a recently created file
Reading critical registry keys
Unauthorized injection to a recently created process
Unauthorized injection to a recently created process by context flags manipulation
Stealing user critical data
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
AVEMARIA
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/254d622b-a275-4a53-acab-3cff1bb005a0
Result
Threat name:
Azorult
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/640866
Signature
.NET source code contains very large array initializations
C2 URLs / IPs found in malware configuration
Found malware configuration
Found many strings related to Crypto-Wallets (likely being stolen)
Hides that the sample has been downloaded from the Internet (zone.identifier)
Injects a PE file into a foreign processes
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for submitted file
Writes to foreign memory regions
Yara detected Azorult
Yara detected Azorult Info Stealer
Behaviour
Behavior Graph:
Download SVG
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/3acf3f2b79ad2c1b58d9331a3754ff8109b0998b5729aba2429103511fa3bd65/
Threat name:
ByteCode-MSIL.Infostealer.CoinStealer
Create hunting rule
Status:
Malicious
First seen:
2021-03-15 11:50:52 UTC
AV detection:
20 of 28 (71.43%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=hlht6k3zvuwbwwgzgmndovh7qee3bgmlk4u2xiscsebvch5dxvsq._file
Verdict:
malicious
Label(s):
azorult
Create hunting rule
Similar samples:
2df55ccbab067e73a2fa36685a48b14d0897f845b7ff25abd75f609fd0dbe415
AZORult
3ebfdbf1ce6802dddfb8338b95545d1e07950ea47b8850a4d8f83e86ad81a3f5
AZORult
8f2fb0c54f7b6c6ccc3bc70cfa83165a4b8905b89744dd98a01ad7f632c82f95
AZORult
99a9903d77272e93c262ae1391ef64f0639835f0cc9fc8b07f6fbc4d1bf40c5a
AZORult
a86f792a5a3d424b756508cb462d3ca9b454f2513a5471df5d41da33649748e9
AZORult
bc568f10fe943dccb25ea6cd830cd4d54fbeef748e7da33bfac086f496c71bb2
AZORult
c5b84e95c3c5d74359f6dcc6d465f7ab9a4709807c15aa08ed258b1e32f39668
AZORult
dd62faf4995b64622a600017699ab4a601dd66027d3fc958d0b372e3d80a1353
AZORult
f2ae8f6f17f52a5a441b4e08441d388d499cfa75058896e7dfba8f58c92a4009
AZORult
fe0a5fde4fbbddd79d2938af2373c69a8219ea73831be712f1bca86150a30461
AZORult
+ 251 additional samples on MalwareBazaar
Result
Malware family:
azorult
Create hunting rule
Score:
  10/10
Tags:
family:azorult discovery infostealer spyware stealer trojan
Link:
https://tria.ge/reports/210316-63v5vgcxq6/
Behaviour
Checks processor information in registry
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Suspicious use of SetThreadContext
Checks installed software on the system
Loads dropped DLL
Reads data files stored by FTP clients
Reads local data of messenger clients
Reads user/profile data of local email clients
Reads user/profile data of web browsers
Executes dropped EXE
Azorult
Malware Config
C2 Extraction:
http://18.157.168.193/index.php
Unpacked files
SH256 hash:
3acf3f2b79ad2c1b58d9331a3754ff8109b0998b5729aba2429103511fa3bd65
MD5 hash:
5d86b7e57a49db2cd1c597b02c3deae4
SHA1 hash:
0e1c004e532d4a38b8ff818439682ab471ced6d1
Link:
https://www.unpac.me/results/079220d1-f97c-4998-9feb-0db78b90b8bd/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Azorult
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/3acf3f2b79ad2c1b58d9331a3754ff8109b0998b5729aba2429103511fa3bd65

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Comments