MalwareBazaar Database
You are currently viewing the MalwareBazaar entry for SHA256 57381c9847a41f83afc199ab0382eabca99a304f73dba7a9e3d8b7815c111389. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.
Database Entry
AZORult
Vendor detections: 6
| SHA256 hash: | 57381c9847a41f83afc199ab0382eabca99a304f73dba7a9e3d8b7815c111389 |
|---|---|
| SHA3-384 hash: | 8dd9033ffaa73ed5572fb897fb35b2d1d075b51bccb6615c5c8213e09bd165d7abb4f1f1dd449cbc929bc74bcbc9974a |
| SHA1 hash: | 04dbeff2795372d22a1e242ef60cb72ec1f6b574 |
| MD5 hash: | 193d80ceb3f8f40f14c2cd2bc2363ab0 |
| humanhash: | mountain-minnesota-vegan-ten |
| File name: | ROC - DELHI-Aircraft- airline spares purchase order-Specifications.rar |
| Download: | download sample |
| Signature | AZORult |
| File size: | 332'156 bytes |
| First seen: | 2022-03-14 07:20:23 UTC |
| Last seen: | Never |
| File type: | rar |
| MIME type: | application/x-rar |
| ssdeep | 6144:IUnAHUmzYAlVsgHnh7+76gDjb/VuypP/LtWhvkwQO2t2qMxsNVIPZZXCEkeSwyl9:rLAlWgHhY1DjTVuyvUQNtQOEHkei9 |
| TLSH | T1EF642383DE500D43347AA3FAAB26042A3639C09FF64DDB6366E4C1D27ADCD572258E31 |
| Reporter |  cocaman |
| Tags: | AZORult rar |
cocaman
Malicious email (T1566.001)From: "ROC - DELHI<mayrauizl94@gmail.com>" (likely spoofed)
Received: "from gmail.com (unknown [31.210.20.90]) "
Date: "14 Mar 2022 05:01:26 +0100"
Subject: "ROC - DELHI-Aircraft Parts, SPARES PURCHASE ORDER SPECIFICATION FROM lgpartner.ch.. Date: Am3/14/2022 5:01:25 a.m. Time: 3/14/2022 5:01:25 a.m."
Attachment: "ROC - DELHI-Aircraft- airline spares purchase order-Specifications.rar"
Intelligence
File Origin
# of uploads :
1
# of downloads :
291
Origin country :
n/a
Vendor Threat Intelligence
Verdict:
Suspicious
Threat level:
5/10
Confidence:
100%
Tags:
control.exe overlay packed shell32.dll
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Threat name:
Win32.Trojan.FormBook
Status:
Malicious
First seen:
2022-03-14 07:21:10 UTC
File Type:
Binary (Archive)
Extracted files:
5
AV detection:
17 of 27 (62.96%)
Threat level:
5/5
Detection(s):
Suspicious file
Result
Malware family:
azorult
Score:
10/10
Tags:
family:azorult collection discovery infostealer spyware stealer trojan
Behaviour
Checks processor information in registry
Suspicious behavior: EnumeratesProcesses
Suspicious use of WriteProcessMemory
outlook_office_path
outlook_win_path
Enumerates physical storage devices
Program crash
Accesses Microsoft Outlook profiles
Accesses cryptocurrency files/wallets, possible credential harvesting
Checks installed software on the system
Loads dropped DLL
Reads data files stored by FTP clients
Reads local data of messenger clients
Reads user/profile data of local email clients
Reads user/profile data of web browsers
Executes dropped EXE
Azorult
Malware Config
C2 Extraction:
http://89.43.107.198/mpom/index.php
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.28
File information
The table below shows additional information about this malware sample such as delivery method and external references.
Malspam
exe Delivery method
Distributed via e-mail attachment
Comments
Login required
You need to login to in order to write a comment. Login with your abuse.ch account.