MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 a620e855497074b6da1cc6ae56b19c3e2e251f6a9b4f43bb0beef655287b3eed. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AZORult


Vendor detections: 6


Intelligence 6 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: a620e855497074b6da1cc6ae56b19c3e2e251f6a9b4f43bb0beef655287b3eed
SHA3-384 hash: 858a5e21244b9278aaca87175ac992bdd5832d760f039e5fad2ffc6dbc64b2621cd35cedba4fa07f9df8fe42f3fc30ea
SHA1 hash: 50736bccd6cff3401626b91e86b05f7fa68f9593
MD5 hash: e4eab1f4a61d788e9eed267c796e37f3
humanhash: saturn-venus-gee-single
File name:CITIUS33XXX10307051121001177.rar
Download: download sample
Signature AZORult
Create hunting rule
File size:332'040 bytes
First seen:2022-03-14 08:49:02 UTC
Last seen:Never
File type: rar
MIME type:application/x-rar
ssdeep 6144:9UnAHUmzYAlVsgHn25LWYmBrWRpnahCX0AkROosFX3hOg6OKxkIPT9mXJ4ED:YLAlWgH2mBrWRpn+WkROocHhykt
TLSH T1D06423C747E66C5B3D2B63129B0E370D2B99E48DF98C9EA7C0D72141FAC5703476468A
Reporter cocaman
Tags:AZORult rar


Avatar
cocaman
Malicious email (T1566.001)
From: "Branch705@bankofbaghdad.com.iq" (likely spoofed)
Received: "from bankofbaghdad.com.iq (unknown [31.210.20.90]) "
Date: "14 Mar 2022 09:03:21 +0100"
Subject: "=?UTF-8?B?Rnc6INit2YjYp9mE2Ycg2YbYs9mK2YUg2KjYutiv2KfYryDYsdmC2YUgNDc0?="
Attachment: "CITIUS33XXX10307051121001177.rar"

Intelligence

File Origin
# of uploads :
1
# of downloads :
286
Origin country :
n/a
Vendor Threat Intelligence
Verdict:
Suspicious
Threat level:
  5/10
Confidence:
100%
Tags:
control.exe overlay packed shell32.dll
Link:
https://www.filescan.io/uploads/622f01850cd58dbd9295093c/reports/e2bc9f88-9fef-471a-9e5c-a7341029b923/overview
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/a620e855497074b6da1cc6ae56b19c3e2e251f6a9b4f43bb0beef655287b3eed/
Threat name:
Win32.Trojan.FormBook
Create hunting rule
Status:
Malicious
First seen:
2022-03-14 09:24:19 UTC
File Type:
Binary (Archive)
Extracted files:
5
AV detection:
19 of 42 (45.24%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=uyqoqvkjob2lnwq4y2xfnmm4hyxckh3ktnhuhoyl533fkkd3h3wq._file
Result
Malware family:
azorult
Create hunting rule
Score:
  10/10
Tags:
family:azorult collection discovery infostealer spyware stealer suricata trojan
Link:
https://tria.ge/reports/220314-kq2dtafhbk/
Behaviour
Checks processor information in registry
Suspicious behavior: EnumeratesProcesses
Suspicious use of WriteProcessMemory
outlook_office_path
outlook_win_path
Enumerates physical storage devices
Program crash
Accesses Microsoft Outlook profiles
Accesses cryptocurrency files/wallets, possible credential harvesting
Checks installed software on the system
Loads dropped DLL
Reads data files stored by FTP clients
Reads local data of messenger clients
Reads user/profile data of local email clients
Reads user/profile data of web browsers
Executes dropped EXE
Azorult
suricata: ET MALWARE AZORult v3.3 Server Response M2
suricata: ET MALWARE Win32/AZORult V3.3 Client Checkin M13
Malware Config
C2 Extraction:
http://89.43.107.198/mpom/index.php
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.28
Link:
https://yomi.yoroi.company/submissions/a620e855497074b6da1cc6ae56b19c3e2e251f6a9b4f43bb0beef655287b3eed

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AZORult

rar a620e855497074b6da1cc6ae56b19c3e2e251f6a9b4f43bb0beef655287b3eed

(this sample)

AZORult

Executable exe 3b1fd9ce0c20b167a2367191a5129c5f635869f6a87f473cfe083e67d7f7465b

  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 3b1fd9ce0c20b167a2367191a5129c5f635869f6a87f473cfe083e67d7f7465b

Comments