MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 af80a0ec35e2521f9bcb52dadbf60329d28aafa5f311c612721da30329fd57eb. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AZORult


Vendor detections: 5


Intelligence 5 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: af80a0ec35e2521f9bcb52dadbf60329d28aafa5f311c612721da30329fd57eb
SHA3-384 hash: 2bd8d6e8d384086f3d18c93cb8f695ca3b1ed44705bd29bf7393eb55b33ff5afb83198cd9bf479c97e331de427338b8a
SHA1 hash: 1715252c488c799f40b8732bcb9ef6bf63cb74c1
MD5 hash: 6557fa0ad443bf50203b1f3769b19dac
humanhash: wolfram-three-indigo-oregon
File name:TTcopy.pdf.exe
Download: download sample
Signature AZORult
Create hunting rule
File size:265'728 bytes
First seen:2020-05-12 09:18:05 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'661 x AgentTesla, 19'474 x Formbook, 12'208 x SnakeKeylogger)
ssdeep 6144:SZUhTxpdzgPImQyNJgyI7Yjz/fr9OfeRYOXNM9Ew:So6ZL3r9OfeR1MOw
Threatray 546 similar samples on MalwareBazaar
TLSH 5244CF37729CAD07C79E15FED050A2148374A36A61D3F7DA2CC284FA25D4BC68586F8B
Reporter abuse_ch
Tags:AZORult exe


Avatar
abuse_ch
Malspam distributing AZORult:

From: Office Maxbet <office@ro.maxbetgroup.com>
Subject: 供你參考,Payment Transfer
Attachment: TTcopy.pdf.rar (contains "TTcopy.pdf.exe")

AZORult C2:
http://waterchem.com.tr/softaculous/Panel/index.php

Intelligence

File Origin
# of uploads :
1
# of downloads :
99
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.MSIL.Kryptik.VFR-1.UNOFFICIAL
Create hunting rule

Gathering data
Threat name:
ByteCode-MSIL.Trojan.Kryptik
Create hunting rule
Status:
Malicious
First seen:
2020-05-12 13:03:00 UTC
File Type:
PE (.Net Exe)
Extracted files:
8
AV detection:
24 of 31 (77.42%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=v6akb3bv4jjb7g6lklnnx5qdfhjivl5f6mi4metsdwrqgkp5k7vq._file
Verdict:
malicious
Label(s):
azorult
Create hunting rule
Similar samples:
227c14f96fe815771903d9c8050d094efc19423e072f06b75a40a5305fb04476
AZORult
2530a6515fbfa1c1828dfe9cf174709002d10b9ae832176fc98fe5679a23bf13
AZORult
4f635247e7b91b2ab53fee1a679785175ee709424deb1e10595aa74410c9a72b
AZORult
718d51708b5bd49d7f9d7f5c145e13d8d27bab6414cfe3694a9fc9269932300e
AZORult
ae807cf8d58d5a64f9275fc3394098c0fe2764d07d12482aa95f1b778257e6fe
AZORult
ca6d1749f9645475aa7ab0ca268e31ba00817a8c70467c4d6d88bb2ca54d596d
AZORult
d3375fae6761e02b05ae0ca40938958b7b025f1072d989b3188ff46ec032505e
AZORult
dff01b9f8946ed3792fe4e32ae3f95834c892f16ca219dc99d78fd15064f82a2
AZORult
eed00acb5b2bd676ab5ae74611ed880e6ef40d855d401ce9a938d5700f2b1de1
AZORult
f29c7a735adfcc42de35a17646ead9eaf23ae1a0cc99ad468b720d0e3be7dad6
AZORult
+ 536 additional samples on MalwareBazaar
Result
Malware family:
azorult
Create hunting rule
Score:
  10/10
Tags:
family:azorult evasion infostealer trojan
Link:
https://tria.ge/reports/201109-7g4wkrvera/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Program crash
Suspicious use of SetThreadContext
Maps connected drives based on registry
Checks BIOS information in registry
Uses the VBS compiler for execution
Looks for VMWare Tools registry key
Looks for VirtualBox Guest Additions in registry
ServiceHost packer
Azorult
Malware Config
C2 Extraction:
http://waterchem.com.tr/softaculous/Panel/index.php
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AZORult

rar b67db987a7ee21bcaaf7274b3361e53a5b2c703f1026ed50872477d52617eec4

AZORult

Executable exe af80a0ec35e2521f9bcb52dadbf60329d28aafa5f311c612721da30329fd57eb

(this sample)

  
Dropped by
MD5 1b3d09629d45613b6274a5ae94cd2c62
  
Delivery method
Distributed via e-mail attachment
  
Dropped by
SHA256 b67db987a7ee21bcaaf7274b3361e53a5b2c703f1026ed50872477d52617eec4

Comments