MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 5cd0979b7c98df1687c313cf78daf8a978574a02e97e62c5a348e08c3b1f34c9. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

AZORult

Vendor detections: 13

Intelligence 13 IOCs YARA 1 File information Comments

SHA256 hash:	5cd0979b7c98df1687c313cf78daf8a978574a02e97e62c5a348e08c3b1f34c9
SHA3-384 hash:	b6fef9e1fcc210c956e34b8933db11d8ec8e090becfeb796a110b81e42dc4d9645fac1791808bb63fa3f7eb2e549a9d3
SHA1 hash:	c47dd492e4c7fd2204019fcea06bc0a9dd2e250c
MD5 hash:	57f69ad1d8f4ca03de19053597368a8d
humanhash:	pasta-johnny-grey-hot
File name:	57f69ad1d8f4ca03de19053597368a8d.exe
Download:	download sample
Signature	AZORult Create hunting rule
File size:	424'960 bytes
First seen:	2021-02-02 08:56:15 UTC
Last seen:	Never
File type:	exe
MIME type:	application/x-dosexec
imphash	f34d5f2d4577ed6d9ceec516c1f5a744 (48'740 x AgentTesla, 19'600 x Formbook, 12'241 x SnakeKeylogger)
ssdeep	6144:icL/rEda0/iei9k8mOalFu027X1mQdysq5mRUa/xREG0Xo6YVT+QvEntVwQBYly2:prqlZi970UqmKQxR10y0QEntVFYs2
Threatray	621 similar samples on MalwareBazaar
TLSH	6494F1252FBC6F5EC27A6FF915B0E11863FD92122825C309CEA129DD7636F885940ED3
Reporter	abuse_ch
Tags:	AZORult exe

abuse_ch

AZORult C2:
http://74.208.108.87/index.php

Intelligence

File Origin

# of uploads :

# of downloads :

302

Origin country :

n/a

Vendor Threat Intelligence

Malware family:

n/a

ID:

File name:

57f69ad1d8f4ca03de19053597368a8d.exe

Verdict:

Malicious activity

Analysis date:

2021-02-02 08:58:42 UTC

Tags:

trojan rat azorult

Link:

https://app.any.run/tasks/86864416-229d-416f-b3d5-f335132aeb4a

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

Detection:

Azorult

Link:

https://www.capesandbox.com/analysis/115101/

Result

Verdict:

Malware

Maliciousness:

Behaviour

Creating a window

Sending a UDP request

Unauthorized injection to a recently created process

Creating a file

Sending an HTTP POST request

Creating a file in the %temp% subdirectories

Deleting a recently created file

Reading critical registry keys

Stealing user critical data

Result

Verdict:

MALICIOUS

Details

Windows PE Executable

Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.

Result

Threat name:

AZORult

Detection:

malicious

Classification:

spyw.evad

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/596369

Signature

Binary contains a suspicious time stamp

Detected AZORult Info Stealer

Found many strings related to Crypto-Wallets (likely being stolen)

Injects a PE file into a foreign processes

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Yara detected AntiVM_3

Yara detected Azorult

Yara detected Azorult Info Stealer

Behaviour

Behavior Graph:

Download SVG

Detection:

azorult

Link:

https://mwdb.cert.pl/sample/5cd0979b7c98df1687c313cf78daf8a978574a02e97e62c5a348e08c3b1f34c9/

Threat name:

ByteCode-MSIL.Trojan.Pwsx

Status:

Malicious

First seen:

2021-02-02 06:11:19 UTC

AV detection:

16 of 46 (34.78%)

Threat level:

5/5

Detection(s):

Malicious file

Link:

https://check.spamhaus.org/check/?searchterm=ltijpg34tdprnb6dcphxrwxyvf4fosqc5f7gfrndjdqiyoy7gteq._file

Verdict:

malicious

Label(s):

azorult

Result

Malware family:

azorult

Score:

10/10

Tags:

family:azorult discovery infostealer spyware trojan

Link:

https://tria.ge/reports/210202-xvl6fr7bp6/

Behaviour

Checks processor information in registry

Suspicious behavior: EnumeratesProcesses

Suspicious use of WriteProcessMemory

Suspicious use of SetThreadContext

Checks installed software on the system

JavaScript code in executable

Loads dropped DLL

Reads data files stored by FTP clients

Reads user/profile data of local email clients

Reads user/profile data of web browsers

Azorult

Malware Config

C2 Extraction:

http://74.208.108.87/index.php

Unpacked files

SH256 hash:

a2a0bbbe8c9ee88441356010f63455c50dfcafe663db757bbc453c815c51d720

MD5 hash:

11e80c54bfeff7f0c120dae46df0a8be

SHA1 hash:

d597b9b0dcac06f0aa00a931bb90de8eba564651

Link:

https://www.unpac.me/results/81634253-e95f-481b-9ee3-72422343e224/

SH256 hash:

a7f78bfd5f50f374943dc07764f2715b34980bfeab8086106cd2fee96e6a3506

MD5 hash:

bde770712b0760d38bf8449a475b6abd

SHA1 hash:

5c70e9de6c89830d4bb7130d5dfb18b3e97c58e6

Link:

https://www.unpac.me/results/81634253-e95f-481b-9ee3-72422343e224/

SH256 hash:

a2292835de1ecbbb272414acfcfedfb0ecf05936063c2237021432f0c8cdbbeb

MD5 hash:

6730790fef20267a04a3a0e3ef213a57

SHA1 hash:

2be3871700c783b52707ad75b5631cc9fdd6c7b0

Detections:

win_azorult_g1

win_azorult_auto

Link:

https://www.unpac.me/results/81634253-e95f-481b-9ee3-72422343e224/

SH256 hash:

5cd0979b7c98df1687c313cf78daf8a978574a02e97e62c5a348e08c3b1f34c9

MD5 hash:

57f69ad1d8f4ca03de19053597368a8d

SHA1 hash:

c47dd492e4c7fd2204019fcea06bc0a9dd2e250c

Link:

https://www.unpac.me/results/81634253-e95f-481b-9ee3-72422343e224/

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Azorult

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/5cd0979b7c98df1687c313cf78daf8a978574a02e97e62c5a348e08c3b1f34c9

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	INDICATOR_SUSPICIOUS_Stomped_PECompilation_Timestamp_InTheFu Create hunting rule
Author:	ditekSHen
Description:	Detect executables with stomped PE compilation timestamp that is greater than local current time