MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 94bd4eac4f76cc1913f9c70e926d6cbd5b5b75a81911db2dc0c279f20e009435. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AZORult


Vendor detections: 6


Intelligence 6 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 94bd4eac4f76cc1913f9c70e926d6cbd5b5b75a81911db2dc0c279f20e009435
SHA3-384 hash: 9fedfa60e427696c5edf1c71f247bb4255c7f60f0f1dbf765d75e3869517debc4d6dbaf4d2b0526ffba22acdf7be871a
SHA1 hash: dbbb945180fb4dae5e0c4fdf1af83fd6d823bd3d
MD5 hash: 4ebeae23b9d66c07c01e371f0ae41f4c
humanhash: coffee-august-cat-chicken
File name:MW4213-specifications -AS-SFT-01..zip
Download: download sample
Signature AZORult
Create hunting rule
File size:331'682 bytes
First seen:2022-03-14 07:20:03 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 6144:P9dgAe1ZQu9Q1RHNQRI6ln9jbChqwUehEPob0iwBaazjpYZ:3jhuu1RH+RIMhbDTeEgIiuaejpYZ
TLSH T1EE6423E884365E8EEBF449D2583F07B2598A4BB28DBAC5FC0F6C5A1314A854F1CF4538
Reporter cocaman
Tags:AZORult zip


Avatar
cocaman
Malicious email (T1566.001)
From: "ROC - DELHI<mayrauizl94@gmail.com>" (likely spoofed)
Received: "from gmail.com (unknown [31.210.20.90]) "
Date: "14 Mar 2022 05:01:26 +0100"
Subject: "ROC - DELHI-Aircraft Parts, SPARES PURCHASE ORDER SPECIFICATION FROM lgpartner.ch.. Date: Am3/14/2022 5:01:25 a.m. Time: 3/14/2022 5:01:25 a.m."
Attachment: "MW4213-specifications -AS-SFT-01..zip"

Intelligence

File Origin
# of uploads :
1
# of downloads :
275
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Sanesecurity.Foxhole.Zip_Hideexe.5.UNOFFICIAL
Create hunting rule

SecuriteInfo.com.Trojan.PWS.Stealer.26518.10606.10048.UNOFFICIAL
Create hunting rule

Verdict:
Suspicious
Threat level:
  5/10
Confidence:
100%
Tags:
control.exe overlay packed shell32.dll
Link:
https://www.filescan.io/uploads/622eeca7b94fb38cb47835a8/reports/c7ed97c4-b0af-4e80-ba8a-d41a0fef6ece/overview
Result
Verdict:
MALICIOUS
Link:
https://labs.inquest.net/dfi/sha256/94bd4eac4f76cc1913f9c70e926d6cbd5b5b75a81911db2dc0c279f20e009435
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/94bd4eac4f76cc1913f9c70e926d6cbd5b5b75a81911db2dc0c279f20e009435/
Threat name:
Win32.Trojan.FormBook
Create hunting rule
Status:
Malicious
First seen:
2022-03-14 05:01:04 UTC
File Type:
Binary (Archive)
Extracted files:
5
AV detection:
12 of 37 (32.43%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=ss6u5lcpo3gbse7zy4hje3lmxvnvw5nidei5wloayj47edqasq2q._file
Result
Malware family:
azorult
Create hunting rule
Score:
  10/10
Tags:
family:azorult collection discovery infostealer spyware stealer trojan
Link:
https://tria.ge/reports/220314-h55cxadgd5/
Behaviour
Checks processor information in registry
Suspicious behavior: EnumeratesProcesses
Suspicious use of WriteProcessMemory
outlook_office_path
outlook_win_path
Enumerates physical storage devices
Program crash
Accesses Microsoft Outlook profiles
Accesses cryptocurrency files/wallets, possible credential harvesting
Checks installed software on the system
Loads dropped DLL
Reads data files stored by FTP clients
Reads local data of messenger clients
Reads user/profile data of local email clients
Reads user/profile data of web browsers
Executes dropped EXE
Azorult
Malware Config
C2 Extraction:
http://89.43.107.198/mpom/index.php
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.28
Link:
https://yomi.yoroi.company/submissions/94bd4eac4f76cc1913f9c70e926d6cbd5b5b75a81911db2dc0c279f20e009435

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AZORult

zip 94bd4eac4f76cc1913f9c70e926d6cbd5b5b75a81911db2dc0c279f20e009435

(this sample)

AZORult

Executable exe 3b1fd9ce0c20b167a2367191a5129c5f635869f6a87f473cfe083e67d7f7465b

  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 3b1fd9ce0c20b167a2367191a5129c5f635869f6a87f473cfe083e67d7f7465b

Comments