MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 c48cb25059f32fc7d90c16a275586d98f18ce43563b6f1a3fbeb282e8f4dd62f. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AZORult


Vendor detections: 9


Intelligence 9 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: c48cb25059f32fc7d90c16a275586d98f18ce43563b6f1a3fbeb282e8f4dd62f
SHA3-384 hash: fb1436dfd44c792546ad6299a2a44c31444413735d9436b53ebe0a120aee12f62a20b4947f2eb5a84f754657d8fa7752
SHA1 hash: 20b24bd05c48d69cd0fd0bb5a7be6e9a2f832590
MD5 hash: 526f579a895b5294709684a3f48a6704
humanhash: uranus-river-comet-crazy
File name:SecuriteInfo.com.Trojan.Packed2.42698.15841.32461
Download: download sample
Signature AZORult
Create hunting rule
File size:386'560 bytes
First seen:2020-11-20 17:00:26 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'652 x AgentTesla, 19'463 x Formbook, 12'204 x SnakeKeylogger)
ssdeep 6144:cyYEzfZeWOI4ab6BVgjNxWTYBgFteceb/1XDxCFysxK2V0zRGDnGeTQGxOir7WV8:cy791OSCgjpgFz81FCrxKfdGDnGcQGx5
Threatray 422 similar samples on MalwareBazaar
TLSH F6848CA8725475EFC85BD5B58A94EC74AA602C6B430B825391D31CEBBA0CA87DF144F3
Reporter SecuriteInfoCom
Tags:AZORult

Intelligence

File Origin
# of uploads :
1
# of downloads :
502
Origin country :
n/a
Vendor Threat Intelligence
Result
Verdict:
Malware
Maliciousness:

Behaviour
Sending a UDP request
Creating a window
Creating a file in the %AppData% directory
Creating a file in the %temp% directory
Launching a process
Creating a process with a hidden window
Deleting a recently created file
Unauthorized injection to a recently created process
Creating a file
Sending an HTTP POST request
Reading critical registry keys
Stealing user critical data
Enabling autorun by creating a file
Result
Verdict:
UNKNOWN
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Result
Threat name:
Azorult
Create hunting rule
Detection:
malicious
Classification:
phis.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/544377
Signature
Binary contains a suspicious time stamp
Found many strings related to Crypto-Wallets (likely being stolen)
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for submitted file
Sigma detected: Scheduled temp file as task from temp location
Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Tries to harvest and steal Bitcoin Wallet information
Tries to harvest and steal browser information (history, passwords, etc)
Tries to harvest and steal ftp login credentials
Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)
Tries to steal Crypto Currency Wallets
Tries to steal Instant Messenger accounts or passwords
Tries to steal Mail credentials (via file access)
Uses schtasks.exe or at.exe to add and modify task schedules
Yara detected AntiVM_3
Yara detected Azorult
Yara detected Azorult Info Stealer
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 321287 Sample: SecuriteInfo.com.Trojan.Pac... Startdate: 20/11/2020 Architecture: WINDOWS Score: 100 35 Snort IDS alert for network traffic (e.g. based on Emerging Threat rules) 2->35 37 Malicious sample detected (through community Yara rule) 2->37 39 Sigma detected: Scheduled temp file as task from temp location 2->39 41 9 other signatures 2->41 7 SecuriteInfo.com.Trojan.Packed2.42698.15841.exe 6 2->7         started        process3 file4 19 C:\Users\user\AppData\Local\...\tmpB5D2.tmp, XML 7->19 dropped 21 SecuriteInfo.com.T...42698.15841.exe.log, ASCII 7->21 dropped 23 C:\Users\user\AppData\...\oSPiRlkVjPPlv.exe, PE32 7->23 dropped 10 SecuriteInfo.com.Trojan.Packed2.42698.15841.exe 63 7->10         started        15 schtasks.exe 1 7->15         started        process5 dnsIp6 33 185.222.57.246, 49717, 49723, 80 ROOTLAYERNETNL Netherlands 10->33 25 C:\Users\user\AppData\...\vcruntime140.dll, PE32 10->25 dropped 27 C:\Users\user\AppData\Local\...\ucrtbase.dll, PE32 10->27 dropped 29 C:\Users\user\AppData\Local\...\softokn3.dll, PE32 10->29 dropped 31 45 other files (none is malicious) 10->31 dropped 43 Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc) 10->43 45 Tries to steal Instant Messenger accounts or passwords 10->45 47 Tries to steal Mail credentials (via file access) 10->47 49 4 other signatures 10->49 17 conhost.exe 15->17         started        file7 signatures8 process9
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/c48cb25059f32fc7d90c16a275586d98f18ce43563b6f1a3fbeb282e8f4dd62f/
Threat name:
ByteCode-MSIL.Trojan.LokiBot
Create hunting rule
Status:
Malicious
First seen:
2020-11-20 11:49:11 UTC
AV detection:
24 of 29 (82.76%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=ysgleucz6mx4pwimc2rhkwdntdyyzzbvmo3pdi735muc5d2n2yxq._file
Verdict:
malicious
Label(s):
azorult
Create hunting rule
Similar samples:
05a1356768e4475daeebaae76e486705d2d920e7e4d511c1436ea3f9a650c1df
AZORult
0fd52c8b8586dfd283eb2b6acac20ed36b7887e56131bad25a61f29e321e13fc
AZORult
44b9088e8bd1c22c10d5ea77951a3dda0884a8564187a8f98a4472120f374c91
AZORult
4f197c8bdfa89d2a0d041b47dabf307cba6c3deb639134357e0bfee3bf28645f
AZORult
6853956661336de789939b113160c9316bc33c213c6633cc98636f107616e538
AZORult
85a40f3f59fb797494adf184b0dbee2b3d8089e9686b9f484c5242c5a75085a9
AZORult
b33a22daaca745cab65dff2ca6043d40fcf67c5216feb9de1648abce9e1a8d66
AZORult
d60af7a38f3b01fa2c7926959f9c65b91d9dac09da0e6e0431237ffd58b2e8f0
AZORult
ed2ea110d8f94b7a3bc57ae52d9d17e26c14fa191878a4bc7711b1083ad1c27e
AZORult
f775e5dbccc816cac60eccab275b5a4babd1046924cc1be39c6bf10d5dc9f608
AZORult
+ 412 additional samples on MalwareBazaar
Result
Malware family:
azorult
Create hunting rule
Score:
  10/10
Tags:
family:azorult infostealer persistence trojan
Link:
https://tria.ge/reports/201120-g9sv21c7ya/
Behaviour
Creates scheduled task(s)
Suspicious use of WriteProcessMemory
Modifies service
Suspicious use of SetThreadContext
Azorult
Malware Config
C2 Extraction:
http://185.222.57.246/key/index.php
Unpacked files
SH256 hash:
c48cb25059f32fc7d90c16a275586d98f18ce43563b6f1a3fbeb282e8f4dd62f
MD5 hash:
526f579a895b5294709684a3f48a6704
SHA1 hash:
20b24bd05c48d69cd0fd0bb5a7be6e9a2f832590
Link:
https://www.unpac.me/results/0bd3a7ad-4fa0-4499-aeaa-5127a0ec57da/
SH256 hash:
c16847f9f117053b54890757e6eb6e03499b14502a0933986cfd0a5a169991ff
MD5 hash:
427e8b89e0195dd53f5e522978f8ea1e
SHA1 hash:
74045cc3157f0172b9c86a60a0a7e66b3bad3dc4
Detections:
win_azorult_g1
Create hunting rule
win_azorult_auto
Create hunting rule
Link:
https://www.unpac.me/results/0bd3a7ad-4fa0-4499-aeaa-5127a0ec57da/
SH256 hash:
cb951f1d2b5460456aad0d89cef1216d9be5e51784d11a92447d43e96177bd5e
MD5 hash:
8cd5d2014866f4ef60802ff1826998a6
SHA1 hash:
8ff75946905d0b117080cc5a07e6e0bbea4e9bbd
Link:
https://www.unpac.me/results/0bd3a7ad-4fa0-4499-aeaa-5127a0ec57da/
SH256 hash:
45f9ea2e9ee95ddbd57a8ef4154694c9caa5faf3328bf14d222339fa3b863a6f
MD5 hash:
7ad0830cfd9d5e734276be42f86acd22
SHA1 hash:
fb0152805aaa234f95c3a7325543f91ad917fa63
Link:
https://www.unpac.me/results/0bd3a7ad-4fa0-4499-aeaa-5127a0ec57da/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
AgentTesla
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/c48cb25059f32fc7d90c16a275586d98f18ce43563b6f1a3fbeb282e8f4dd62f

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

AZORult

Executable exe c48cb25059f32fc7d90c16a275586d98f18ce43563b6f1a3fbeb282e8f4dd62f

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/836914/
  
Delivery method
Distributed via web download

Comments