MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 bfddf9b66d9ff554b0144c5a7b6ef13c7965ae4f53c6f52a67c5577fff9d9602. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AZORult


Vendor detections: 10


Intelligence 10 IOCs YARA 3 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: bfddf9b66d9ff554b0144c5a7b6ef13c7965ae4f53c6f52a67c5577fff9d9602
SHA3-384 hash: 92d7f944ce4b2c05bc6eedab2201f04d39f59a798a0959afe130f81fa3892cb9b90559a646569a106418b2e1d577a5d3
SHA1 hash: fe7b3cef50c3db4a768acef0cc03e8e83101fef6
MD5 hash: 2a2ea12a3be49a9237c9fcd2094f5ea9
humanhash: low-jig-quiet-london
File name:SecuriteInfo.com.Artemis2A2EA12A3BE4.5654.1422
Download: download sample
Signature AZORult
Create hunting rule
File size:894'976 bytes
First seen:2021-05-06 17:55:58 UTC
Last seen:2021-05-06 18:49:07 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'666 x AgentTesla, 19'479 x Formbook, 12'209 x SnakeKeylogger)
ssdeep 12288:Ec9CoROrAoLLoS60/K7yh0oX92K43n29xQ4bqoH4y3jJOGxDO0GFfU8JxphpBsQ7:EYJMrAoLA3/n29xdRzAIOtJxb
Threatray 1'042 similar samples on MalwareBazaar
TLSH E11528EC761075EEC61BCC22DBCE1C1596202176572B9607932303BD9E0EE57AF389E6
Reporter SecuriteInfoCom
Tags:AZORult

Intelligence

File Origin
# of uploads :
3
# of downloads :
263
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/151822/
Detection(s):
SecuriteInfo.com.Artemis2A2EA12A3BE4.5654.1422.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
Sending a UDP request
Unauthorized injection to a recently created process
Creating a file
Sending an HTTP POST request
Creating a file in the %temp% subdirectories
Deleting a recently created file
Reading critical registry keys
Stealing user critical data
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Result
Threat name:
AZORult
Create hunting rule
Detection:
malicious
Classification:
phis.troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/714505
Signature
C2 URLs / IPs found in malware configuration
Detected AZORult Info Stealer
Detected unpacking (changes PE section rights)
Detected unpacking (overwrites its own PE header)
Found malware configuration
Found many strings related to Crypto-Wallets (likely being stolen)
Injects a PE file into a foreign processes
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for domain / URL
Multi AV Scanner detection for submitted file
Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Tries to harvest and steal browser information (history, passwords, etc)
Tries to harvest and steal ftp login credentials
Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)
Tries to steal Instant Messenger accounts or passwords
Tries to steal Mail credentials (via file access)
Yara detected AntiVM3
Yara detected Azorult
Yara detected Azorult Info Stealer
Behaviour
Behavior Graph:
Download SVG
Detection:
azorult
Create hunting rule
Link:
https://mwdb.cert.pl/sample/bfddf9b66d9ff554b0144c5a7b6ef13c7965ae4f53c6f52a67c5577fff9d9602/
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2021-05-06 11:07:34 UTC
AV detection:
21 of 29 (72.41%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=x7o7tntnt72vjmaujrnhw3xrhr4wllspkpdpkkthyvlx7745syba._file
Verdict:
unknown
Similar samples:
007b982d8c612faaf3305f2a45ea52d972c4a52c7fc0f791ba1d0cbf61b55c69
AZORult
24e0dea3fd8da18a3063cb1692651b30ec3f0b6d28a34fc9f15748e08a6648d4
AZORult
25bff5f2080e1071fa169deb5b4d12c40c56567d479dc81f86d79d4f3e5f9a90
AZORult
2d25d136b12c900209489988b87ec94520c0734f4f31d4497fa47dfefc551bb4
AZORult
3938b573134eabe9228b7f4cf6a433fc42846a8aa53060072b15efe955bc9f93
AZORult
5159183c50d03b79bf325655cefff8b847ffbb4b1d1f1f8228e4dc1dfe7eec8e
AZORult
5af2bcd6e1359e4f5ff0b1f0d91397edb7dfeb3b6e5fef9cb73fd0bbf907b161
AZORult
65d873e82fc6d0e63a224589cdee5551f2d98c313e19adbc9799ef17ae493a8f
AZORult
99a0a4ce4a345e3729c6177c979011f01d2272541d94e284b4da18c6cd59fd9c
AZORult
da889f40e6ee1f71dbc8282fa19dbeee68f5028384af7f96f620bd4f23d2de42
AZORult
+ 1'032 additional samples on MalwareBazaar
Result
Malware family:
azorult
Create hunting rule
Score:
  10/10
Tags:
family:azorult discovery infostealer spyware stealer trojan
Link:
https://tria.ge/reports/210506-g29gzvm49x/
Behaviour
Checks processor information in registry
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Suspicious use of SetThreadContext
Checks installed software on the system
Loads dropped DLL
Reads data files stored by FTP clients
Reads local data of messenger clients
Reads user/profile data of local email clients
Reads user/profile data of web browsers
Azorult
Malware Config
C2 Extraction:
http://31.210.20.121/index.php
Unpacked files
SH256 hash:
74b2935b9dfe4ba397fd0507ae3c36abb77193041f2e7c43c55dc4e7b33de61c
MD5 hash:
b5c218f30fecc9cb8513ff6a46737b01
SHA1 hash:
f0416867c2b114789620b318051f1fa390b07eae
Link:
https://www.unpac.me/results/7e3c3588-5d99-4a4c-af95-34376cdf3b48/
SH256 hash:
fbacc1e327da97f5933647cdcdfd9fd27336b1467e9e799c5e33472f55d7b554
MD5 hash:
b9cd5e67fb2bc5c034001339d32f92b6
SHA1 hash:
9ec7ec0b358f5b25ff5807b1c7715b672a468391
Detections:
win_azorult_g1
Create hunting rule
win_azorult_auto
Create hunting rule
Link:
https://www.unpac.me/results/7e3c3588-5d99-4a4c-af95-34376cdf3b48/
Parent samples :
3278e9c4c457276373847b00e038409b6a14170cf4cedf0879c757df80040247
44a553892af9e23cabd74bef11e9bc8fe08dd0f111a482248f90e8d2f54ae06e
e72e42080f815a61e8e641bb3ebc9d2e0f0161604c55cbf76c5be1e16262b712
bfddf9b66d9ff554b0144c5a7b6ef13c7965ae4f53c6f52a67c5577fff9d9602
ceeda097c923c87e4477bb50a66414773be8bf57e643e0c6bf79e949a8648e1a
SH256 hash:
a98bd2ba7c25974c57fe7739bf39a374856f1f379740d79ac30995c78bd81d2b
MD5 hash:
031fa03f404a35fbbf696e51b5c7ed90
SHA1 hash:
1ca816e680e4faa53847a3b3c44bd349087e3b35
Link:
https://www.unpac.me/results/7e3c3588-5d99-4a4c-af95-34376cdf3b48/
SH256 hash:
bfddf9b66d9ff554b0144c5a7b6ef13c7965ae4f53c6f52a67c5577fff9d9602
MD5 hash:
2a2ea12a3be49a9237c9fcd2094f5ea9
SHA1 hash:
fe7b3cef50c3db4a768acef0cc03e8e83101fef6
Link:
https://www.unpac.me/results/7e3c3588-5d99-4a4c-af95-34376cdf3b48/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/bfddf9b66d9ff554b0144c5a7b6ef13c7965ae4f53c6f52a67c5577fff9d9602

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:INDICATOR_SUSPICIOUS_Stomped_PECompilation_Timestamp_InTheFu
Create hunting rule
Author:ditekSHen
Description:Detect executables with stomped PE compilation timestamp that is greater than local current time
Rule name:pe_imphash
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

AZORult

Executable exe bfddf9b66d9ff554b0144c5a7b6ef13c7965ae4f53c6f52a67c5577fff9d9602

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/1200739/
  
Delivery method
Distributed via web download
Cape
Cape
https://www.capesandbox.com/analysis/151822/

Comments