MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 6853956661336de789939b113160c9316bc33c213c6633cc98636f107616e538. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

AZORult

Vendor detections: 9

Intelligence 9 IOCs YARA 2 File information Comments

SHA256 hash:	6853956661336de789939b113160c9316bc33c213c6633cc98636f107616e538
SHA3-384 hash:	f5f72c9d7ff630c36299e017e9948c1e635ad8c8a908588f1bd00fef116ac89fc37020d8d6f1787ecc379a85451b874b
SHA1 hash:	c94e30aad15569d6afd711c795c96a6c5b086780
MD5 hash:	e8ef12fb6ac6a992887189b4779deb12
humanhash:	bacon-echo-bacon-echo
File name:	PROFORMA INV SCAN COPY #8220_pdf.exe
Download:	download sample
Signature	AZORult Create hunting rule
File size:	194'560 bytes
First seen:	2020-10-22 07:10:35 UTC
Last seen:	Never
File type:	exe
MIME type:	application/x-dosexec
imphash	f34d5f2d4577ed6d9ceec516c1f5a744 (48'657 x AgentTesla, 19'468 x Formbook, 12'206 x SnakeKeylogger)
ssdeep	3072:wUr6tD/Sw7aUosft9pmxqhx8JXykX+OxM2Yc3sMAVVwaib477u7obwRmn5Q/4+eb:wUr6tD/rfT76ikX+OxGrTjW4Hu7Bo5zN
Threatray	1'066 similar samples on MalwareBazaar
TLSH	A5148C407696888FE3C144B3F89AA835ABCDDE0DF111EB2A6762F14056BD3D6345293F
Reporter	abuse_ch
Tags:	AZORult exe

abuse_ch

Malspam distributing AZORult:

HELO: smtp7.whygroup.it
Sending IP: 130.117.239.117
From: Nghien Cuu Phat Trien <sales@silopcorp.vn>
Reply-To: nklaun59@gmail.com
Subject: DOCUMENTS & INV SCAN COPY #8220
Attachment: PROFORMA INV SCAN COPY 8220_pdf.zip (contains "PROFORMA INV SCAN COPY #8220_pdf.exe")

AZORult C2:
http://kmtrealestate.com.na/PL341/index.php

AgentTesla payload URL:
http://plasticsheets.ie/Chrome.exe

Intelligence

File Origin

# of uploads :

# of downloads :

135

Origin country :

n/a

Vendor Threat Intelligence

Detection:

Azorult

Link:

https://www.capesandbox.com/analysis/74517/

Result

Verdict:

Malware

Maliciousness:

Behaviour

Sending a UDP request

Using the Windows Management Instrumentation requests

Creating a file

DNS request

Sending an HTTP POST request

Creating a file in the %temp% subdirectories

Deleting a recently created file

Reading critical registry keys

Sending an HTTP GET request

Creating a process from a recently created file

Running batch commands

Creating a process with a hidden window

Launching a process

Creating a window

Stealing user critical data

Unauthorized injection to a recently created process

Enabling autorun by creating a file

Result

Threat name:

Azorult

Detection:

malicious

Classification:

spyw.evad

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/506763

Signature

Creates an undocumented autostart registry key

Initial sample is a PE file and has a suspicious name

Injects a PE file into a foreign processes

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Yara detected Azorult

Yara detected Azorult Info Stealer

Behaviour

Behavior Graph:

Download SVG

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/6853956661336de789939b113160c9316bc33c213c6633cc98636f107616e538/

Threat name:

ByteCode-MSIL.Infostealer.Stelega

Status:

Malicious

First seen:

2020-10-22 04:53:56 UTC

AV detection:

23 of 29 (79.31%)

Threat level:

5/5

Detection(s):

Malicious file

Link:

https://check.spamhaus.org/check/?searchterm=nbjzkztbgnw6pcmttmitcygjgfv4gpbbhrtdhteymnxra5qw4u4a._file

Verdict:

malicious

Label(s):

azorult

agenttesla

Result

Malware family:

azorult

Score:

10/10

Tags:

spyware discovery trojan infostealer family:azorult

Link:

https://tria.ge/reports/201022-sj1lzyjyws/

Behaviour

Checks processor information in registry

Delays execution with timeout.exe

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

Suspicious use of SetThreadContext

Accesses cryptocurrency files/wallets, possible credential harvesting

Checks installed software on the system

JavaScript code in executable

Deletes itself

Loads dropped DLL

Reads data files stored by FTP clients

Reads user/profile data of local email clients

Reads user/profile data of web browsers

Executes dropped EXE

Azorult

Unpacked files

SH256 hash:

6853956661336de789939b113160c9316bc33c213c6633cc98636f107616e538

MD5 hash:

e8ef12fb6ac6a992887189b4779deb12

SHA1 hash:

c94e30aad15569d6afd711c795c96a6c5b086780

Link:

https://www.unpac.me/results/0d80fc7d-7425-4b64-8030-08e45d609aba/

SH256 hash:

1e6b3cb944718816f4c3183403fe8dc9ecc408cce1fd82e5b8cd22dd2b284830

MD5 hash:

b89347696e49ed37913a2d405631a964

SHA1 hash:

e5c4bcdbf0ea0dde8662a0400848a244e4553b7a

Detections:

win_azorult_g1

win_azorult_auto

Link:

https://www.unpac.me/results/0d80fc7d-7425-4b64-8030-08e45d609aba/

SH256 hash:

8a12414f2097ba326634a0a9e46b51eb001050d0808dbb8ce929a45ef438eafb

MD5 hash:

2f55875d5184e4bebe0a0f4ec6c907b0

SHA1 hash:

9ebf9d824d277cb5496308578b716037b9e512e7

Link:

https://www.unpac.me/results/0d80fc7d-7425-4b64-8030-08e45d609aba/

SH256 hash:

5fda7ee9bc5175075ee399ebf129d02f46eee3955ec06d359409e913ba7612d7

MD5 hash:

a10645a9d67ce46819443318e9b3063c

SHA1 hash:

a1ba5cfd0eb7fda77e513e3cc5c647baba61e29e

Link:

https://www.unpac.me/results/0d80fc7d-7425-4b64-8030-08e45d609aba/

Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.