MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 c9aedd0a4102a2838a1d06c3c4f9ed0d60c04c21f6fa40c0ea78e10070200e5d. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AZORult


Vendor detections: 9


Intelligence 9 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: c9aedd0a4102a2838a1d06c3c4f9ed0d60c04c21f6fa40c0ea78e10070200e5d
SHA3-384 hash: 0fc1796601e9c2c223bb8b2394fca47022391196b46cafb21d8fd0df5df6feaeb81145b0b3723eac413f8d5ac74527a3
SHA1 hash: d6fa63c2378383f431c4a9a3bc199c3939f819c2
MD5 hash: 9975b6911529c6eb17c0f9114f9cc46a
humanhash: spring-mobile-failed-kentucky
File name:Order6749782100.exe
Download: download sample
Signature AZORult
Create hunting rule
File size:256'128 bytes
First seen:2020-10-10 06:43:42 UTC
Last seen:2020-10-10 08:04:46 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'740 x AgentTesla, 19'600 x Formbook, 12'241 x SnakeKeylogger)
ssdeep 3072:zL8VXjaacER73JcKcESdXXHWuFHhrpMFEOp:H8NjBcKGXXpMtp
Threatray 301 similar samples on MalwareBazaar
TLSH 5144072D72C4BC52FA7A9A7696E14C5E9D3371A20E55833D51EC8DC971E0088F723E8B
Reporter abuse_ch
Tags:AZORult exe


Avatar
abuse_ch
Malspam distributing AZORult:

HELO: ichememember.org
Sending IP: 208.67.21.44
From: DHA MORROCO <purchasemanager@africamail.com>
Subject: Order6749782100
Attachment: Order6749782100.rar (contains "Order6749782100.exe")

AZORult C2:
http://books.myscriptcase.com/index.php

Intelligence

File Origin
# of uploads :
2
# of downloads :
227
Origin country :
n/a
Vendor Threat Intelligence
Detection:
Azorult
Create hunting rule
Link:
https://www.capesandbox.com/analysis/69697/
Result
Verdict:
Malware
Maliciousness:

Behaviour
Launching a process
Creating a process with a hidden window
Sending a UDP request
DNS request
Sending a custom TCP request
Adding an access-denied ACE
Unauthorized injection to a recently created process
Launching the default Windows debugger (dwwin.exe)
Sending an HTTP POST request to an infection source
Sending an HTTP GET request to an infection source
Result
Threat name:
AZORult
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/487408
Signature
Connects to a pastebin service (likely for C&C)
Contains functionality to hide a thread from the debugger
Detected AZORult Info Stealer
Found malware configuration
Found many strings related to Crypto-Wallets (likely being stolen)
Hides threads from debuggers
Initial sample is a PE file and has a suspicious name
Injects a PE file into a foreign processes
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for domain / URL
Multi AV Scanner detection for submitted file
Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)
Yara detected Azorult
Yara detected Azorult Info Stealer
Behaviour
Behavior Graph:
Download SVG
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/c9aedd0a4102a2838a1d06c3c4f9ed0d60c04c21f6fa40c0ea78e10070200e5d/
Threat name:
ByteCode-MSIL.Trojan.Wacatac
Create hunting rule
Status:
Malicious
First seen:
2020-10-09 08:57:49 UTC
AV detection:
20 of 29 (68.97%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=zgxn2csbakrihcq5a3b4j6pnbvqmatbb635ebqhkpdqqa4babzoq._file
Verdict:
malicious
Label(s):
azorult
Create hunting rule
Similar samples:
4639769fea49849bb1a85d41d7dc9f4975e0945b3e5b0622503a71b8a97faccf
AZORult
50871b11ec8d79116e3e61c9e082967e6327e58a7478b92b16cb821ec23dcf79
AZORult
655455e4c04c7fd6e624b752797305264093264c08b0ab45ebfceee5f7abbc66
AZORult
6d7dc72817910ada384e0c5d6569b046706c68af888627798db937e81c9baea6
AZORult
90006ca498f8b95df09f017dc722da49302813fd5c483f9aec3a1f444fbad87f
AZORult
c578d33e132ccbbc26a4a31e6054fea7f42591b391e9b8eb30eaf732ed119088
AZORult
ce06efe2c18c75da9d9535b4328677f4136a3f04ea666d037bf55dce7c9b7c57
AZORult
e53cd448b2fad21583ddd160f9b6cdfacbec7a8c9c7ae9712c4c39972daa4c18
AZORult
eb96ab93249a86be52aa53a58fb8667b4c54f6b6dbc899fd23ea56b12b52a001
AZORult
eece64fe2e9e21564eb410e0d750e9cc605f0b4c437c5b90d9d2ae0ed10ceed9
AZORult
+ 291 additional samples on MalwareBazaar
Result
Malware family:
azorult
Create hunting rule
Score:
  10/10
Tags:
trojan infostealer family:azorult
Link:
https://tria.ge/reports/201010-d15gnsz16j/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Delays execution with timeout.exe
Program crash
Suspicious use of NtSetInformationThreadHideFromDebugger
Suspicious use of SetThreadContext
Legitimate hosting services abused for malware hosting/C2
Azorult
Malware Config
C2 Extraction:
http://books.myscriptcase.com/index.php
Unpacked files
SH256 hash:
c9aedd0a4102a2838a1d06c3c4f9ed0d60c04c21f6fa40c0ea78e10070200e5d
MD5 hash:
9975b6911529c6eb17c0f9114f9cc46a
SHA1 hash:
d6fa63c2378383f431c4a9a3bc199c3939f819c2
Link:
https://www.unpac.me/results/2f691f07-f8e2-4de0-a402-c1a43085070e/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Kryptik
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/c9aedd0a4102a2838a1d06c3c4f9ed0d60c04c21f6fa40c0ea78e10070200e5d

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AZORult

rar 1bff51783b71b95dd4a8a14e87fe0cfd10cdf46bafa821baea9ce50e818fd6af

AZORult

Executable exe c9aedd0a4102a2838a1d06c3c4f9ed0d60c04c21f6fa40c0ea78e10070200e5d

(this sample)

  
Dropped by
MD5 bac77bad3935cd3e8eee49a93e9698d7
  
Delivery method
Distributed via e-mail attachment
Cape
Cape
https://www.capesandbox.com/analysis/69697/
  
Dropped by
SHA256 1bff51783b71b95dd4a8a14e87fe0cfd10cdf46bafa821baea9ce50e818fd6af

Comments