MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 5870ba9274f3eac3690f01c263c104de1a1729075b03e666d175cbf1fdd9b8cb. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AZORult


Vendor detections: 10


Intelligence 10 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 5870ba9274f3eac3690f01c263c104de1a1729075b03e666d175cbf1fdd9b8cb
SHA3-384 hash: 223904fc59b01fb743e21801d00a24798271ca0cdcb5e56d8c32d7b211f1c951ca2f4ea65fa9789d3e7ccd7f2a68148f
SHA1 hash: 7e72b6d88de26b3226426e3e1700d75a79ea9b1d
MD5 hash: 4cb84c2129875005315fa3de51c493fe
humanhash: pennsylvania-texas-xray-sixteen
File name:SecuriteInfo.com.Trojan.PWS.Stealer.26517.1316.1988
Download: download sample
Signature AZORult
Create hunting rule
File size:373'248 bytes
First seen:2020-12-01 20:52:40 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'665 x AgentTesla, 19'478 x Formbook, 12'208 x SnakeKeylogger)
ssdeep 6144:wdKQgz66E/qXX1vb50+HCYYRqARazuqHWj9gbZWjHyQ/F3fpQm6n87R:v6/qH12+a5YuqHWhUQHy8fpQm6ns
Threatray 439 similar samples on MalwareBazaar
TLSH 468401ED7720B1EEC857C436CAAC1C78AA6074BB571B954B806742DEDA4C99BCF140F2
Reporter SecuriteInfoCom
Tags:AZORult

Intelligence

File Origin
# of uploads :
1
# of downloads :
249
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/106291/
Detection(s):
SecuriteInfo.com.Trojan.PWS.Stealer.26517.1316.1988.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
Unauthorized injection to a recently created process
Creating a file
Sending an HTTP POST request
Creating a file in the %temp% subdirectories
Deleting a recently created file
Reading critical registry keys
Stealing user critical data
Result
Verdict:
SUSPICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Result
Threat name:
AZORult
Create hunting rule
Detection:
malicious
Classification:
phis.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/552987
Signature
Binary contains a suspicious time stamp
Detected AZORult Info Stealer
Detected unpacking (changes PE section rights)
Found many strings related to Crypto-Wallets (likely being stolen)
Injects a PE file into a foreign processes
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for submitted file
PE file contains section with special chars
PE file has nameless sections
Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Tries to harvest and steal browser information (history, passwords, etc)
Tries to harvest and steal ftp login credentials
Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)
Tries to steal Instant Messenger accounts or passwords
Tries to steal Mail credentials (via file access)
Yara detected AntiVM_3
Yara detected Azorult
Yara detected Azorult Info Stealer
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 325590 Sample: SecuriteInfo.com.Trojan.PWS... Startdate: 01/12/2020 Architecture: WINDOWS Score: 100 29 Snort IDS alert for network traffic (e.g. based on Emerging Threat rules) 2->29 31 Malicious sample detected (through community Yara rule) 2->31 33 Multi AV Scanner detection for submitted file 2->33 35 9 other signatures 2->35 6 SecuriteInfo.com.Trojan.PWS.Stealer.26517.1316.exe 3 2->6         started        process3 file4 17 SecuriteInfo.com.T....26517.1316.exe.log, ASCII 6->17 dropped 37 Detected unpacking (changes PE section rights) 6->37 39 Detected AZORult Info Stealer 6->39 41 Injects a PE file into a foreign processes 6->41 10 SecuriteInfo.com.Trojan.PWS.Stealer.26517.1316.exe 62 6->10         started        15 SecuriteInfo.com.Trojan.PWS.Stealer.26517.1316.exe 6->15         started        signatures5 process6 dnsIp7 27 158.101.98.57, 49719, 49725, 80 ORACLE-BMC-31898US United States 10->27 19 C:\Users\user\AppData\...\vcruntime140.dll, PE32 10->19 dropped 21 C:\Users\user\AppData\Local\...\ucrtbase.dll, PE32 10->21 dropped 23 C:\Users\user\AppData\Local\...\softokn3.dll, PE32 10->23 dropped 25 45 other files (none is malicious) 10->25 dropped 43 Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc) 10->43 45 Tries to steal Instant Messenger accounts or passwords 10->45 47 Tries to steal Mail credentials (via file access) 10->47 49 2 other signatures 10->49 file8 signatures9
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/5870ba9274f3eac3690f01c263c104de1a1729075b03e666d175cbf1fdd9b8cb/
Threat name:
ByteCode-MSIL.Backdoor.NanoCore
Create hunting rule
Status:
Malicious
First seen:
2020-12-01 01:52:59 UTC
AV detection:
25 of 29 (86.21%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=lbylvetu6pvmg2ipahbghqie3ynbokihlmb6mzwroxf7d7ozxdfq._file
Verdict:
malicious
Label(s):
azorult
Create hunting rule
Similar samples:
4551d06a33be96c8808d2e180d6cf35c50cbf2dc114a51e90aa49bb4597e2936
AZORult
62ddfbbb9039c0671aa08af5d0fdd0fe949eb96e435c631a57e931e4b19743a9
AZORult
655455e4c04c7fd6e624b752797305264093264c08b0ab45ebfceee5f7abbc66
AZORult
84f409f8aee0cf253fba68ae4027348449045f7bfb8723ac8fe0336c21c0b0f6
AZORult
886cec0fe0e68cd029b2f082e65009e46205d4f4fefa5d70923031ab5982fbc1
AZORult
aee6577ef4a0d538fecd2596cedc2cdcd8eed86e9267c1bb40b0a17fbb5e51a3
AZORult
af80a0ec35e2521f9bcb52dadbf60329d28aafa5f311c612721da30329fd57eb
AZORult
bca4b6e9f14cb4d84674d2f4db286e0ea692f68e8b1d906d04ced807556c6174
AZORult
ce06efe2c18c75da9d9535b4328677f4136a3f04ea666d037bf55dce7c9b7c57
AZORult
e53cd448b2fad21583ddd160f9b6cdfacbec7a8c9c7ae9712c4c39972daa4c18
AZORult
+ 429 additional samples on MalwareBazaar
Result
Malware family:
azorult
Create hunting rule
Score:
  10/10
Tags:
family:azorult infostealer trojan
Link:
https://tria.ge/reports/201201-bwy6txpj8s/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Suspicious use of SetThreadContext
Azorult
Malware Config
C2 Extraction:
http://158.101.98.57/index.php
Unpacked files
SH256 hash:
5870ba9274f3eac3690f01c263c104de1a1729075b03e666d175cbf1fdd9b8cb
MD5 hash:
4cb84c2129875005315fa3de51c493fe
SHA1 hash:
7e72b6d88de26b3226426e3e1700d75a79ea9b1d
Link:
https://www.unpac.me/results/cbf61088-56a5-43a1-bd4f-5b0364d2d512/
SH256 hash:
40a645d444e44b804a110ce99d0c18c676a74315f9bd607383aa72e8a33ce9bc
MD5 hash:
7a50b4758f419df0c157458ed38fd559
SHA1 hash:
23e1358ca32638310640839a85be194f3b16ee6f
Link:
https://www.unpac.me/results/cbf61088-56a5-43a1-bd4f-5b0364d2d512/
SH256 hash:
cb951f1d2b5460456aad0d89cef1216d9be5e51784d11a92447d43e96177bd5e
MD5 hash:
8cd5d2014866f4ef60802ff1826998a6
SHA1 hash:
8ff75946905d0b117080cc5a07e6e0bbea4e9bbd
Link:
https://www.unpac.me/results/cbf61088-56a5-43a1-bd4f-5b0364d2d512/
SH256 hash:
2b9f694e7b9450b9960c227858c0ec901d79b56de168374c2aaf7ce2d927d7a7
MD5 hash:
99a0b33a7cfc78c290e563aeb34eb6a5
SHA1 hash:
c70d567dd8038868f1e8374520dfad6b95cdb5bf
Detections:
win_azorult_g1
Create hunting rule
win_azorult_auto
Create hunting rule
Link:
https://www.unpac.me/results/cbf61088-56a5-43a1-bd4f-5b0364d2d512/
Parent samples :
fdc67fedfe7d517e76232c036cd8b77e80e5c32e5214dd0a606062cb06460b66
5870ba9274f3eac3690f01c263c104de1a1729075b03e666d175cbf1fdd9b8cb
ee0fc921e6afbab3b831c73d06b39c933ba99e64b4156cb69c627b1561431af0
bb50ec005b943e5906c449de4b21d1d6f7f2b5b377f01886032c576cfacca298
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
AgentTesla
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/5870ba9274f3eac3690f01c263c104de1a1729075b03e666d175cbf1fdd9b8cb

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

AZORult

Executable exe 5870ba9274f3eac3690f01c263c104de1a1729075b03e666d175cbf1fdd9b8cb

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/880119/
  
Delivery method
Distributed via web download
Cape
Cape
https://www.capesandbox.com/analysis/106291/

Comments