MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 baf6a75e20150f7383f636a2a41241dd6f5a1fcfbfec13944ebd8e02479123ee. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

AZORult

Vendor detections: 4

Intelligence 4 IOCs YARA File information Comments

SHA256 hash:	baf6a75e20150f7383f636a2a41241dd6f5a1fcfbfec13944ebd8e02479123ee
SHA3-384 hash:	da343ff78755f07f81dead57d033d60a7442f8a26cf09efe0a6d9e7569b17c23c82c82e6b9262df5fe1e6204531fd391
SHA1 hash:	c8962128528c91b21a141d78fd287a8ca5d7f5c0
MD5 hash:	faa9e139d240d38e15189b6dda2d2afd
humanhash:	yankee-snake-delaware-indigo
File name:	anyisouthz.exe
Download:	download sample
Signature	AZORult Create hunting rule
File size:	684'032 bytes
First seen:	2020-03-27 06:29:50 UTC
Last seen:	2020-03-27 07:15:18 UTC
File type:	exe
MIME type:	application/x-dosexec
imphash	1ce642d8ae591286f72c5076cbdda92a (4 x FormBook, 3 x AgentTesla, 1 x AZORult)
ssdeep	12288:r9cW1pusQR7tkglIYH0EhBWqnH5fN+WCQip//4Xf:rlZOtkkB08D58WCQN
Threatray	327 similar samples on MalwareBazaar
TLSH	37E49F72B2F04433C12B2A3CDD5BA764AC2ABE116938A9466FF51C4C5F39781353E297
Reporter	JoulK
Tags:	AZORult

Jouliok

Exfil: POST hxxp://logroom[.]top/anyisouth/index.php

Intelligence

File Origin

# of uploads :

# of downloads :

Origin country :

n/a

Vendor Threat Intelligence

Detection(s):

PUA.Win.Adware.Slugin-6803969-0

PUA.Win.Adware.Slugin-6840354-0

Gathering data

Threat name:

Win32.Trojan.Injector

Status:

Malicious

First seen:

2020-03-27 13:12:07 UTC

File Type:

PE (Exe)

Extracted files:

AV detection:

27 of 31 (87.10%)

Threat level:

5/5

Detection(s):

Malicious file

Link:

https://check.spamhaus.org/check/?searchterm=xl3koxracuhxha7wg2rkiesb3vxvuh6px7wbhfcoxwhaer4repxa._file

Verdict:

malicious

Label(s):

azorult

Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

AZORult

exe baf6a75e20150f7383f636a2a41241dd6f5a1fcfbfec13944ebd8e02479123ee

(this sample)

any.run

https://app.any.run/tasks/3bd54d8b-0401-4575-82e7-0c25f553bccc

URLhaus

https://urlhaus.abuse.ch/url/330283/

Delivery method

Distributed via web download

BLint

The following table provides more information about this file using BLint. BLint is a Binary Linter to check the security properties, and capabilities in executables.

Findings

ID	Title	Severity
CHECK_AUTHENTICODE	Missing Authenticode	high
CHECK_NX	Missing Non-Executable Memory Protection	critical
CHECK_PIE	Missing Position-Independent Executable (PIE) Protection	high

Reviews

ID	Capabilities	Evidence
COM_BASE_API	Can Download & Execute components	ole32.dll::CoCreateInstance ole32.dll::CreateStreamOnHGlobal
WIN32_PROCESS_API	Can Create Process and Threads	kernel32.dll::CloseHandle kernel32.dll::CreateThread
WIN_BASE_API	Uses Win Base API	kernel32.dll::LoadLibraryExA kernel32.dll::LoadLibraryA kernel32.dll::GetDriveTypeA kernel32.dll::GetVolumeInformationA kernel32.dll::GetSystemInfo kernel32.dll::GetStartupInfoA
WIN_BASE_IO_API	Can Create Files	kernel32.dll::CreateFileA kernel32.dll::GetFileAttributesA kernel32.dll::FindFirstFileA version.dll::GetFileVersionInfoSizeA version.dll::GetFileVersionInfoA
WIN_BASE_USER_API	Retrieves Account Information	kernel32.dll::GetComputerNameA
WIN_REG_API	Can Manipulate Windows Registry	advapi32.dll::RegOpenKeyExA advapi32.dll::RegQueryValueExA
WIN_USER_API	Performs GUI Actions	user32.dll::ActivateKeyboardLayout user32.dll::CreateMenu user32.dll::FindWindowA user32.dll::PeekMessageA user32.dll::CreateWindowExA

Comments

Login required

You need to login to in order to write a comment. Login with your abuse.ch account.

No comments found for this malware sample