🤲🏼 NEW | abuse.ch Community Hub! Earn recognition 🏅 for the malware intelligence you share, climb the leaderboards 📈, and connect with like-minded contributors who share your hunting focus 🤝. Ready to unlock your profile? Go to the Community Hub →

MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 a45050c77b4e39ac5aeea0252fb07b995c6160f8df2e7f726f51fbef7f0d6930. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AZORult


Vendor detections: 6


Intelligence 6 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: a45050c77b4e39ac5aeea0252fb07b995c6160f8df2e7f726f51fbef7f0d6930
SHA3-384 hash: 74afeb5893bad14435278c3d8778b219c9b1d61a46dbb593015af186a21b39dc5668a7a89be147d2110030a5e441d015
SHA1 hash: c35c17b1557f5ece6985c101cc749c58686ad437
MD5 hash: a25f556674ab5a3cbf291971450f43f2
humanhash: seventeen-four-happy-alabama
File name:PRODUCT INQUIRY 2022.r20
Download: download sample
Signature AZORult
Create hunting rule
File size:953'574 bytes
First seen:2022-04-01 10:09:02 UTC
Last seen:Never
File type: rar
MIME type:application/x-rar
ssdeep 24576:QEIY4ncB3BGA3qcW1HZnbJQPT8kpfA3nAQ9ETi1D:QEw7Dcc5lkg4nRWV
TLSH T1571533713E8C4EFA1A5742C3DE376A76FA8E4010903620DEFFD1951661D69AADE0339C
Reporter cocaman
Tags:AZORult r20 rar


Avatar
cocaman
Malicious email (T1566.001)
From: "sales<talktosales@q4inc.com>" (likely spoofed)
Received: "from q4inc.com (unknown [62.197.136.138]) "
Date: "01 Apr 2022 11:18:09 +0200"
Subject: "Product Inquiry 2022"
Attachment: "PRODUCT INQUIRY 2022.r20"

Intelligence

File Origin
# of uploads :
1
# of downloads :
475
Origin country :
n/a
Vendor Threat Intelligence
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
obfuscated packed
Link:
https://www.filescan.io/uploads/6246cf7d9253b276b7be9814/reports/6bdf11cd-33c5-4c48-a91d-de00b1832334/overview
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/a45050c77b4e39ac5aeea0252fb07b995c6160f8df2e7f726f51fbef7f0d6930/
Threat name:
Win32.Spyware.Azorult
Create hunting rule
Status:
Malicious
First seen:
2022-04-01 09:50:47 UTC
File Type:
Binary (Archive)
Extracted files:
22
AV detection:
12 of 26 (46.15%)
Threat level:
  2/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=urifbr33jy42ywxouass7md3tfogcyhy34xh64tpkh5667ynneya._file
Result
Malware family:
azorult
Create hunting rule
Score:
  10/10
Tags:
family:azorult infostealer persistence suricata trojan
Link:
https://tria.ge/reports/220401-l7cmfsedhm/
Behaviour
Delays execution with timeout.exe
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Suspicious use of SetThreadContext
Adds Run key to start application
Checks computer location settings
Azorult
suricata: ET MALWARE Win32/AZORult V3.3 Client Checkin M13
suricata: ET MALWARE Win32/AZORult V3.3 Client Checkin M5
Malware Config
C2 Extraction:
http://bl1we4t.xyz/index.php
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Azorult
Score:
0.90
Link:
https://yomi.yoroi.company/submissions/a45050c77b4e39ac5aeea0252fb07b995c6160f8df2e7f726f51fbef7f0d6930

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AZORult

rar a45050c77b4e39ac5aeea0252fb07b995c6160f8df2e7f726f51fbef7f0d6930

(this sample)

AZORult

Executable exe 55d6cf850bc8e1f91d1d5b0905eed004df00da757e7ffc80fead608ff18f1e69

  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 55d6cf850bc8e1f91d1d5b0905eed004df00da757e7ffc80fead608ff18f1e69
  
Dropping
AZORult

Comments