MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 b5f5510913ba0d0dbc4b1e2e1f19bf0a12cd6feadc1ddf0d1fea9be8966e2859. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AZORult


Vendor detections: 10


Intelligence 10 IOCs YARA 2 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: b5f5510913ba0d0dbc4b1e2e1f19bf0a12cd6feadc1ddf0d1fea9be8966e2859
SHA3-384 hash: ab63109c1a2c1ffa648f539462beeae5afdeb6940d7130275fbbed09a3c5c44a6f067ba26c41bc530113b3b63986663e
SHA1 hash: 35de0ff70d8d01aa754d839b53bb6b8546de6da5
MD5 hash: 907d348b6919d285faff6bf0dfddcbb3
humanhash: pluto-lactose-floor-avocado
File name:CCMA Reminder Case CCMAJK12671882 GAJK.pdf.exe
Download: download sample
Signature AZORult
Create hunting rule
File size:377'856 bytes
First seen:2020-10-05 11:14:50 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'652 x AgentTesla, 19'463 x Formbook, 12'204 x SnakeKeylogger)
ssdeep 6144:mhXTcH1fu9uKdgSZvy4raeXjuMkqryNPs0tpwfSz3msjxA/MFXQhw:mhD4fqRBdy4r3XyMb6U0tkGFkMdQ
Threatray 137 similar samples on MalwareBazaar
TLSH 00842950F14388A9C8970BF39437C8B1A4767E99E9704E0D31CE73390EB775A12AED5A
Reporter abuse_ch
Tags:AZORult exe


Avatar
abuse_ch
Malspam distributing AZORult:

HELO: host.noanfair.com
Sending IP: 69.64.34.145
From: caseoffice@ccma.org.za
Subject: URGENT - CCMA Reminder: Case CCMAJK12671882 (GAJK) is scheduled for 'Arbitration' for Mon 12-October-2020 10:00
Attachment: CCMA Reminder Case CCMAJK12671882 GAJK.pdf.gz (contains "CCMA Reminder Case CCMAJK12671882 GAJK.pdf.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
167
Origin country :
n/a
Vendor Threat Intelligence
Detection:
Azorult
Create hunting rule
Link:
https://www.capesandbox.com/analysis/68131/
Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
Creating a file in the %temp% subdirectories
Unauthorized injection to a recently created process
Creating a file
Sending an HTTP POST request
Deleting a recently created file
Reading critical registry keys
Running batch commands
Creating a process with a hidden window
Launching a process
Stealing user critical data
Result
Threat name:
AZORult
Create hunting rule
Detection:
malicious
Classification:
phis.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/481260
Signature
.NET source code contains very large array initializations
Binary contains a suspicious time stamp
Detected AZORult Info Stealer
Found malware configuration
Found many strings related to Crypto-Wallets (likely being stolen)
Initial sample is a PE file and has a suspicious name
Injects a PE file into a foreign processes
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for submitted file
Sigma detected: Suspicious Double Extension
Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)
Tries to detect virtualization through RDTSC time measurements
Tries to harvest and steal Bitcoin Wallet information
Tries to harvest and steal browser information (history, passwords, etc)
Tries to harvest and steal ftp login credentials
Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)
Tries to steal Crypto Currency Wallets
Tries to steal Instant Messenger accounts or passwords
Tries to steal Mail credentials (via file access)
Uses an obfuscated file name to hide its real file extension (double extension)
Yara detected Azorult
Yara detected Azorult Info Stealer
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 293071 Sample: CCMA Reminder Case CCMAJK12... Startdate: 05/10/2020 Architecture: WINDOWS Score: 100 37 Snort IDS alert for network traffic (e.g. based on Emerging Threat rules) 2->37 39 Found malware configuration 2->39 41 Malicious sample detected (through community Yara rule) 2->41 43 12 other signatures 2->43 8 CCMA Reminder Case CCMAJK12671882 GAJK.pdf.exe 5 2->8         started        process3 file4 23 CCMA Reminder Case...82 GAJK.pdf.exe.log, ASCII 8->23 dropped 25 C:\Users\user\AppData\Local\Temp\...\f.dll, PE32 8->25 dropped 45 Injects a PE file into a foreign processes 8->45 12 CCMA Reminder Case CCMAJK12671882 GAJK.pdf.exe 67 8->12         started        signatures5 process6 dnsIp7 35 185.239.242.174, 49745, 49748, 80 CLOUDIE-AS-APCloudieLimitedHK Moldova Republic of 12->35 27 C:\Users\user\AppData\...\vcruntime140.dll, PE32 12->27 dropped 29 C:\Users\user\AppData\Local\...\ucrtbase.dll, PE32 12->29 dropped 31 C:\Users\user\AppData\Local\...\softokn3.dll, PE32 12->31 dropped 33 45 other files (none is malicious) 12->33 dropped 47 Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc) 12->47 49 Tries to steal Instant Messenger accounts or passwords 12->49 51 Tries to steal Mail credentials (via file access) 12->51 53 4 other signatures 12->53 17 cmd.exe 1 12->17         started        file8 signatures9 process10 process11 19 conhost.exe 17->19         started        21 timeout.exe 1 17->21         started       
Detection:
azorult
Create hunting rule
Link:
https://mwdb.cert.pl/sample/b5f5510913ba0d0dbc4b1e2e1f19bf0a12cd6feadc1ddf0d1fea9be8966e2859/
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2020-10-05 10:35:32 UTC
AV detection:
23 of 29 (79.31%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=wx2vccitxigq3pcldyxb6gn7bijm237k3qo56di75kn6rftofbmq._file
Verdict:
unknown
Similar samples:
22c3cc5bc8bb078f468b2e502ea5054aeaa77a7638c71aeedef7acd075e9af01
AZORult
69842a6dc654dfc2d3a69b566e90679318cbac7209d4286df9af58b8e173ab90
AZORult
73f6286bd85316cb72796f461e1ad724b8434837f1a10a4a625862c3a7e3c173
AZORult
8c6c41d8e0f478b1be11b938bf83066e8cf7a8b294c18c91e0b2570f464bc6d2
AZORult
a4b6103b1dfe717301995f598b140b0ce26e7a1541f45b6ed6485c05dca2692a
AZORult
c1830ba81a707357031fc8e5cd7cf3a6083c30f33669fe29590cc639140d6780
AZORult
ccd1a40e599ad9f364ca70ef3d02b4850901fdeaddb5c9a4b66405e2bccc9ad2
AZORult
d44272fe83f10383b50e8268ffe5f7f70e1c2b355363ccde038172f6a9eb5479
AZORult
d9600ffc9406d71c60b7eb036248230510c3b971a1de563ca7b8b57e822f7879
AZORult
fbe07dca7476dba15e9dd639c2b5a71c6bbdf21b0f50ee1fde6aa5bc13e19243
AZORult
+ 127 additional samples on MalwareBazaar
Result
Malware family:
azorult
Create hunting rule
Score:
  10/10
Tags:
spyware discovery trojan infostealer family:azorult
Link:
https://tria.ge/reports/201005-ylgvrnewpe/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Checks processor information in registry
Delays execution with timeout.exe
Suspicious use of SetThreadContext
Checks installed software on the system
JavaScript code in executable
Deletes itself
Loads dropped DLL
Reads data files stored by FTP clients
Reads user/profile data of local email clients
Reads user/profile data of web browsers
Azorult
Malware Config
C2 Extraction:
http://185.239.242.174/oue/index.php
Unpacked files
SH256 hash:
b5f5510913ba0d0dbc4b1e2e1f19bf0a12cd6feadc1ddf0d1fea9be8966e2859
MD5 hash:
907d348b6919d285faff6bf0dfddcbb3
SHA1 hash:
35de0ff70d8d01aa754d839b53bb6b8546de6da5
Link:
https://www.unpac.me/results/3058221c-9e87-4c29-8022-25b192319259/
SH256 hash:
b80155dbd80f8bc5d3f59e08df47aefa42e73612aac6e8845fad3cae516cbdb0
MD5 hash:
0478256ba4237f2e33b77f8127d9a145
SHA1 hash:
560f2cd098bd81c18174d980652b28a8c90c48e2
Link:
https://www.unpac.me/results/3058221c-9e87-4c29-8022-25b192319259/
SH256 hash:
38478a941ecc94efc1c6455022c117ea69d52d9837b2ce38c586eefaec85190b
MD5 hash:
da57b179275369b9998e2f69826cc060
SHA1 hash:
5ca96d399d87f6ae7a537ab4e46815f1cc04ec8c
Detections:
win_azorult_g1
Create hunting rule
win_azorult_auto
Create hunting rule
Link:
https://www.unpac.me/results/3058221c-9e87-4c29-8022-25b192319259/
SH256 hash:
6588cb59743ca04e6fb14256ed375908c9a74840b37df3eaa4d9e520f747e430
MD5 hash:
36bf02bda20d358a18f7ac65b7d7ac6c
SHA1 hash:
a08c8bb774773bd957adaf80ee544e53cc43679d
Link:
https://www.unpac.me/results/3058221c-9e87-4c29-8022-25b192319259/
SH256 hash:
19d9922060be89a70b76e5c0056e751f1baa5d41819235c92cf4f5d7668e1267
MD5 hash:
811864a0b06c529af894a7fec6ddbf47
SHA1 hash:
d35b82933eb06a6ec60e8cbbdb65eb6cdcaeb6d2
Link:
https://www.unpac.me/results/3058221c-9e87-4c29-8022-25b192319259/
Parent samples :
afa2f55e149097f9b250142bbfd94d9d56d10649c96adb079fdb0dfdac7c6660
69e2ae11e1b5cbe120bf02301191a1cf05e87fc09b09d63bd782abbf3615d05d
0b778873c94f6bc89a40294c0e85a38ab82509260cd2a2e8b73d00c5c90e8757
7ddfa6f44a60f4b894321f6977f8121cfb371c3c61ac872c58ba61fd5ee13deb
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
0.80
Link:
https://yomi.yoroi.company/submissions/b5f5510913ba0d0dbc4b1e2e1f19bf0a12cd6feadc1ddf0d1fea9be8966e2859

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:Trojan_W32_Gh0stMiancha_1_0_0
Create hunting rule
Rule name:win_azorult_auto
Create hunting rule
Author:Felix Bilstein - yara-signator at cocacoding dot com
Description:autogenerated rule brought to you by yara-signator

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AZORult

gz 6ea4a8a5e4a6626b4655dc388c9b1641333166f0229a769bb81180ef0e29d961

AZORult

Executable exe b5f5510913ba0d0dbc4b1e2e1f19bf0a12cd6feadc1ddf0d1fea9be8966e2859

(this sample)

  
Dropped by
MD5 a168ec04cb1e40437705cb320de3b63a
  
Delivery method
Distributed via e-mail attachment
  
Dropped by
SHA256 6ea4a8a5e4a6626b4655dc388c9b1641333166f0229a769bb81180ef0e29d961
Cape
Cape
https://www.capesandbox.com/analysis/68131/

Comments