MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 5c52d01a13034d617c28365f534c392ec264c3d755dc36ff188082081af05688. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AZORult


Vendor detections: 12


Intelligence 12 IOCs YARA 2 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 5c52d01a13034d617c28365f534c392ec264c3d755dc36ff188082081af05688
SHA3-384 hash: 4fb515a73d70b644ad055492c38d2f428813d91ea4b84af21028c57ba70c6bcd62cbcfaa0490922d3d929d102b3e42d6
SHA1 hash: 2eb840304c4821beaaf1933f261c6aa57dcb01af
MD5 hash: 3e684b02e60492929d1b59f26b95fe80
humanhash: wisconsin-double-west-chicken
File name:3e684b02e60492929d1b59f26b95fe80.exe
Download: download sample
Signature AZORult
Create hunting rule
File size:786'432 bytes
First seen:2022-02-18 11:03:56 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'652 x AgentTesla, 19'463 x Formbook, 12'204 x SnakeKeylogger)
ssdeep 12288:KUMha5VkoPHtrfpzlh4R490q7xA9dpRQ2Z1gJn59XOoC/bPfrwu55E9DMV:uuHtrllI49H8VQ2zgl3X+/b75
Threatray 951 similar samples on MalwareBazaar
TLSH T1FBF49E5231EF1196C362EBF10BD8ADBF865AFD73120E753A35817E97A735A008902772
File icon (PE):PE icon
dhash icon 68686cdcc6a6d2e1 (13 x AgentTesla, 5 x Formbook, 4 x AZORult)
Reporter abuse_ch
Tags:AZORult exe

Intelligence

File Origin
# of uploads :
1
# of downloads :
947
Origin country :
n/a
Vendor Threat Intelligence
Detection:
Azorult
Create hunting rule
Link:
https://www.capesandbox.com/analysis/242503/
Detection(s):
SecuriteInfo.com.Trojan.Siggen16.57439.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
Sending a custom TCP request
Unauthorized injection to a recently created process
Creating a file
Verdict:
Suspicious
Threat level:
  5/10
Confidence:
100%
Tags:
obfuscated packed
Link:
https://www.filescan.io/uploads/620f7d28a2660f3bb9fa9e19/reports/78f4e618-edb8-44d7-b775-64c1480ab270/overview
Result
Verdict:
UNKNOWN
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
AZORult
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/931b2694-e4a7-49a9-a32c-cedcbd1993cf
Result
Threat name:
Azorult
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/942163
Signature
.NET source code contains potential unpacker
.NET source code contains very large strings
Antivirus / Scanner detection for submitted sample
Antivirus detection for URL or domain
C2 URLs / IPs found in malware configuration
Found malware configuration
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for domain / URL
Multi AV Scanner detection for submitted file
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Yara detected AntiVM3
Yara detected Azorult
Yara detected Azorult Info Stealer
Behaviour
Behavior Graph:
Download SVG
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/5c52d01a13034d617c28365f534c392ec264c3d755dc36ff188082081af05688/
Threat name:
ByteCode-MSIL.Infostealer.Azorult
Create hunting rule
Status:
Malicious
First seen:
2022-02-18 03:34:52 UTC
File Type:
PE (.Net Exe)
Extracted files:
12
AV detection:
19 of 28 (67.86%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=lrjnagqtangwc7bigzpvgtbzf3bgjq6xkxodn7yyqcbaqgxqk2ea._file
Verdict:
malicious
Label(s):
azorult
Create hunting rule
Similar samples:
17722dec32e466d6008f0a80ca4f875ce9f3b4856bae7a882ecf451ac5b2fd0e
AZORult
6d730e5cc1d0a05b2018becd2c1eda249e222de5cd8eae34b07f372225bd3e08
AZORult
a4982c5c5b78167a77ab4a79f7189ba5acc7ff49cf9d8a4f12b2967925c1f0c4
AZORult
a6e653d4bb64ac6a0cbad5de254f5282a96d70a83c3642870b6dbac78a200bc9
AZORult
ac40890fee93449d900fd2248ffc6d12e807546d3c39fc40f38d8dc791a49ad5
AZORult
afa9c8dfed5854fb55279a38fe6dcf64c0c3f8617107dbc672960d94ccca409c
AZORult
c57dfaaa1c64fbf06960185a807b04b04d3cf281dd32a2d0dc4bd8169584a50b
AZORult
+ 941 additional samples on MalwareBazaar
Result
Malware family:
azorult
Create hunting rule
Score:
  10/10
Tags:
family:azorult infostealer trojan
Link:
https://tria.ge/reports/220218-m6al5sdcdq/
Behaviour
Checks processor information in registry
Modifies data under HKEY_USERS
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Drops file in Windows directory
Suspicious use of SetThreadContext
Azorult
Malware Config
C2 Extraction:
http://australiadish.bar/kendrick/index.php
Unpacked files
SH256 hash:
658c80f34df29800e29a4112d11cda1f861c5622cff223d43c026ee191473fc0
MD5 hash:
024c4790ae1fee2b1280f5b26da2bc6b
SHA1 hash:
e9e34165a3ffaad39aaec159387b333f3cff378a
Detections:
win_azorult_g1
Create hunting rule
win_azorult_auto
Create hunting rule
Link:
https://www.unpac.me/results/bc6547ec-87d5-4f9c-8af7-2596e250830a/
Parent samples :
3ca1b9b8c365e7329e540d4e84320f0bf61e50a4bab5be54460d0c3e2f320ce1
fd5e6989ff1e8e4ef24bbb2b67018ef8adbdf0da5d489cd142fd8e1a033ce92e
10fed6bb7e0d98d4c39fecce52838efecad2e6d836ceabaf40b438e6790e8abf
d8c4fb5e1c854c9362c4129efbaa6b72435b8e93df66fd418f288650d360ff22
fb253ba653005c97ec369d37d3ef234e85989984c77296bc8f763b53cbb07ab9
f188d2c47c9f395e6063a2fe69edf5830c4d520e11f21421a1814d3202503c45
85e16c4fe21b79d748d246527b80cacb62c90b75f331e774d7cef90d3f3764f5
5c52d01a13034d617c28365f534c392ec264c3d755dc36ff188082081af05688
SH256 hash:
1a5b8010bd8e8f78b6f261228853d5dfdc74615e0af1aba6057437c0c340d6c6
MD5 hash:
e7394ae6aeae9aa548f41c1fcb807d35
SHA1 hash:
8bb23fe465529bdde2f0027b6334cbc41b2a3414
Link:
https://www.unpac.me/results/bc6547ec-87d5-4f9c-8af7-2596e250830a/
SH256 hash:
9dcaa6b03c24d84addfbacda2b3fb74c04c9ee1b18ea43c09e15c1247dc4a533
MD5 hash:
54a52ac7d270f03029e734ba38e6c697
SHA1 hash:
75bacf9fb5e590d10186c2c60280a78b28e0c801
Link:
https://www.unpac.me/results/bc6547ec-87d5-4f9c-8af7-2596e250830a/
SH256 hash:
d81735d504f94031fda0dc59c13d14f8c4c1ba79951e566db5d76d75979e4231
MD5 hash:
f4e241486af5adfc28dd6bedaf4d3f78
SHA1 hash:
55bcf43752b68e1ce12a8223f889ee4ff8942544
Link:
https://www.unpac.me/results/bc6547ec-87d5-4f9c-8af7-2596e250830a/
SH256 hash:
5c52d01a13034d617c28365f534c392ec264c3d755dc36ff188082081af05688
MD5 hash:
3e684b02e60492929d1b59f26b95fe80
SHA1 hash:
2eb840304c4821beaaf1933f261c6aa57dcb01af
Link:
https://www.unpac.me/results/bc6547ec-87d5-4f9c-8af7-2596e250830a/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/5c52d01a13034d617c28365f534c392ec264c3d755dc36ff188082081af05688

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:pe_imphash
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

AZORult

Executable exe 5c52d01a13034d617c28365f534c392ec264c3d755dc36ff188082081af05688

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/2038758/
  
Delivery method
Distributed via web download
Cape
Cape
https://www.capesandbox.com/analysis/242503/

Comments