MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 866444d9139177a3c6dc187dccd1629a48b402c6ee401075c13d51e6224cc1ca. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AZORult


Vendor detections: 8


Intelligence 8 IOCs 1 YARA 2 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 866444d9139177a3c6dc187dccd1629a48b402c6ee401075c13d51e6224cc1ca
SHA3-384 hash: 79564b2a49ef9c2330aba630681b16ab933addc6a0e32d1359067929e8725fef99ff2c5bcfdaa916d3f26292035f5a21
SHA1 hash: 5db81b8e550ac1c91161927715484cacaaa323a6
MD5 hash: c15e14c3d2754f39fb12586831d1c5f8
humanhash: cold-nevada-whiskey-cup
File name:Ziraat Bankasi Swift Mesaji.exe
Download: download sample
Signature AZORult
Create hunting rule
File size:601'600 bytes
First seen:2021-09-01 12:30:48 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash ef471c0edf1877cd5a881a6a8bf647b9 (83 x Formbook, 33 x Loki, 31 x Loda)
ssdeep 12288:iXe9PPlowWX0t6mOQwg1Qd15CcYk0We1rgGkOiEWBp7eIh8EjnbArUUmMv:3hloDX0XOf41iEI7QYnbAhbv
Threatray 4'190 similar samples on MalwareBazaar
TLSH T143D4235588D48CE2F726B33280738ED519F975338CD16B38D354E92E78B0287A89396F
dhash icon aae2f3e38383b629 (2'034 x Formbook, 1'183 x CredentialFlusher, 666 x AgentTesla)
Reporter abuse_ch
Tags:AZORult exe


Avatar
abuse_ch
AZORult C2:
http://37.0.11.174/PL341/index.php

Indicators Of Compromise (IOCs)

Below is a list of indicators of compromise (IOCs) associated with this malware samples.

IOCThreatFox Reference
http://37.0.11.174/PL341/index.php https://threatfox.abuse.ch/ioc/204438/

Intelligence

File Origin
# of uploads :
1
# of downloads :
1'071
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
Ziraat Bankasi Swift Mesaji.exe
Verdict:
Malicious activity
Analysis date:
2021-09-01 12:35:58 UTC
Tags:
trojan rat azorult stealer
Link:
https://app.any.run/tasks/124904d8-6535-4e5f-b141-9a2b460253e9

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/184449/
Detection(s):
PUA.Win.Packer.Upolyx-12
Create hunting rule

SecuriteInfo.com.W32.AIDetect.malware1.26871.13679.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
Creating a file in the %temp% directory
Deleting a recently created file
Launching a process
Connection attempt
Sending an HTTP POST request
Creating a file
Reading critical registry keys
Sending a UDP request
Stealing user critical data
Unauthorized injection to a system process
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/afa8c8c7-63fe-4d1b-9d17-b96d0de2e8aa
Result
Threat name:
Azorult
Create hunting rule
Detection:
malicious
Classification:
phis.troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/843302
Signature
AutoIt script contains suspicious strings
C2 URLs / IPs found in malware configuration
DLL side loading technique detected
Found malware configuration
Found many strings related to Crypto-Wallets (likely being stolen)
Malicious sample detected (through community Yara rule)
Maps a DLL or memory area into another process
Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)
Tries to harvest and steal Bitcoin Wallet information
Tries to harvest and steal browser information (history, passwords, etc)
Tries to harvest and steal ftp login credentials
Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)
Tries to steal Crypto Currency Wallets
Tries to steal Instant Messenger accounts or passwords
Tries to steal Mail credentials (via file access)
Writes to foreign memory regions
Yara detected Azorult
Yara detected Azorult Info Stealer
Behaviour
Behavior Graph:
Download SVG
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/866444d9139177a3c6dc187dccd1629a48b402c6ee401075c13d51e6224cc1ca/
Threat name:
ByteCode-MSIL.Trojan.Nymeria
Create hunting rule
Status:
Malicious
First seen:
2021-09-01 12:31:07 UTC
AV detection:
15 of 45 (33.33%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=qzsejwitsf32hrw4db64zulctjeliawg5zaba5obhvi6mismyhfa._file
Verdict:
malicious
Label(s):
azorult
Create hunting rule
Similar samples:
0caaaa5f4ab21a8ceaaded6e69be05b30e424980e159c6458b0c8379adee95da
AZORult
1d76e4bf41a1674e4459f76b2696e50a7e8330924654c7cfeee2f641357b87a8
AZORult
2b9bbbaf6a14855602a42ae4fcb16003a58bf9d2c02a5e304877e8fa3de9dad5
AZORult
5d0e5fe6f84c394371c174a358770010a2a1338563cf5c19659b9cb0c2d2aa69
AZORult
9218a2c4cfd9538b65b06202b850c2900e625477b176708d44e09a6bafbb5d43
AZORult
996c8fc0d84978d5827249e3573f0002535a18f0e317f31d244049bd58d74ee0
AZORult
a4c035de8a4edb11a8cfaef2f2f8326d8909578cf9d5a5534edd4eb9d5a50680
AZORult
b8cedaeefb46ff748af412d63d33b2d508966d4e33fd88efc592072b64017f5c
AZORult
c031a0c89f56acf4ad9590b807787709a0ff35e792effc0c723288106689ab10
AZORult
f2dcf747bef15584ddd0242430a2374ef9b3b3b542b25cfd75589ec2d3dc66d6
AZORult
+ 4'180 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  8/10
Tags:
upx
Link:
https://tria.ge/reports/210901-gd8x6txd6a/
Behaviour
Suspicious behavior: MapViewOfSection
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Unpacked files
SH256 hash:
46562b9ef1528169fa84209f0584709313f4ba55d8ce47c0c7312857dd55fcbd
MD5 hash:
0ec66f5673aea07887fe115ec76de7c4
SHA1 hash:
72f2c444a71a1b82677eaf507d1f26a76716d983
Detections:
win_azorult_g1
Create hunting rule
win_azorult_auto
Create hunting rule
Link:
https://www.unpac.me/results/72adc336-e67a-41e7-878d-980095518a74/
SH256 hash:
82181feef7f771b83a2507f4190b584cb0098185765a8031fabcc11c8a1662bf
MD5 hash:
166e66e2ebf35b6cd7dec9cc32148b17
SHA1 hash:
44da381061aafeaea7729c3a900d62a21a083def
Link:
https://www.unpac.me/results/72adc336-e67a-41e7-878d-980095518a74/
SH256 hash:
866444d9139177a3c6dc187dccd1629a48b402c6ee401075c13d51e6224cc1ca
MD5 hash:
c15e14c3d2754f39fb12586831d1c5f8
SHA1 hash:
5db81b8e550ac1c91161927715484cacaaa323a6
Link:
https://www.unpac.me/results/72adc336-e67a-41e7-878d-980095518a74/
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/866444d91391/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Suspicious File
Score:
0.49
Link:
https://yomi.yoroi.company/submissions/866444d9139177a3c6dc187dccd1629a48b402c6ee401075c13d51e6224cc1ca

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:Azorult
Create hunting rule
Author:JPCERT/CC Incident Response Group
Description:detect Azorult in memory
Reference:internal research
Rule name:win_azorult_auto
Create hunting rule
Author:Felix Bilstein - yara-signator at cocacoding dot com
Description:Detects win.azorult.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/184449/

Comments