MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 cb34bcf1043d10a15d4a823fe188296e161b88b630f090c8dc644de84b6105ae. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AZORult


Vendor detections: 9


Intelligence 9 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: cb34bcf1043d10a15d4a823fe188296e161b88b630f090c8dc644de84b6105ae
SHA3-384 hash: 25061a26368fe1a602651232853e714bbd0494756f60764f63d815c4fa7a25903290f49d3949b45088bc9edf050c2942
SHA1 hash: 1e38e234ff91a79733f960fba17972cc956d4074
MD5 hash: 48ca734044cf115b599af5dc400c5fb1
humanhash: edward-mars-papa-nineteen
File name:EFT0012021011412560054_148,pdf.com
Download: download sample
Signature AZORult
Create hunting rule
File size:478'720 bytes
First seen:2021-01-14 06:54:38 UTC
Last seen:2021-01-14 08:53:04 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash a846e0e5a50a721e6f501c5c4cf92e0f (1 x AveMariaRAT, 1 x AZORult)
ssdeep 6144:MaeZ1PfSMah0XvpQm4HzH7oa8S/kY6xJrFUL+D8p4AswQMsZVW2AFZC+pljr3Y:deZVS9hieBSbrFiM8EbZkT7njr3Y
Threatray 797 similar samples on MalwareBazaar
TLSH 4AA47F26B3E19437D1731E7CDD1793A9982ABE913D245C866BE82C4CDF39741382A393
Reporter abuse_ch
Tags:AZORult Citibank com


Avatar
abuse_ch
Malspam distributing AZORult:

HELO: box0.citibank.pw
Sending IP: 164.90.153.210
From: Citibank N.A. Indonesia <paylink.asia@citibank.pw>
Subject: Payment Advice-BFTI_EFT0012021011412560054_148_001
Attachment: EFT0012021011412560054_148,pdf.001 (contains "EFT0012021011412560054_148,pdf.com")

AZORult C2:
http://hurriway.xyz/231/index.php

Intelligence

File Origin
# of uploads :
2
# of downloads :
302
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
EFT0012021011412560054_148,pdf.com
Verdict:
Malicious activity
Analysis date:
2021-01-14 07:01:56 UTC
Tags:
installer trojan rat azorult
Link:
https://app.any.run/tasks/85067f43-0863-4786-ac29-a2ffce73d382

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/111936/
Detection(s):
PUA.Win.Adware.Slugin-6803969-0
Create hunting rule

PUA.Win.Adware.Slugin-6840354-0
Create hunting rule

Result
Verdict:
Clean
Maliciousness:
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Result
Threat name:
Azorult
Create hunting rule
Detection:
malicious
Classification:
phis.troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/580932
Signature
Allocates memory in foreign processes
Binary contains a suspicious time stamp
C2 URLs / IPs found in malware configuration
Creates a thread in another existing process (thread injection)
Found malware configuration
Found many strings related to Crypto-Wallets (likely being stolen)
Injects a PE file into a foreign processes
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for domain / URL
Multi AV Scanner detection for submitted file
Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)
Tries to harvest and steal browser information (history, passwords, etc)
Tries to harvest and steal ftp login credentials
Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)
Tries to steal Instant Messenger accounts or passwords
Tries to steal Mail credentials (via file access)
Writes to foreign memory regions
Yara detected Azorult
Yara detected Azorult Info Stealer
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 339496 Sample: EFT0012021011412560054_148,... Startdate: 14/01/2021 Architecture: WINDOWS Score: 100 24 cdn.onenote.net 2->24 36 Snort IDS alert for network traffic (e.g. based on Emerging Threat rules) 2->36 38 Multi AV Scanner detection for domain / URL 2->38 40 Found malware configuration 2->40 42 7 other signatures 2->42 7 EFT0012021011412560054_148,pdf.exe 19 2->7         started        signatures3 process4 dnsIp5 26 1drv.ws 168.235.93.122, 443, 49711, 49714 RAMNODEUS United States 7->26 28 iiz3ag.bn.files.1drv.com 7->28 30 bn-files.fe.1drv.com 7->30 44 Writes to foreign memory regions 7->44 46 Allocates memory in foreign processes 7->46 48 Creates a thread in another existing process (thread injection) 7->48 50 Injects a PE file into a foreign processes 7->50 11 ieinstal.exe 62 7->11         started        signatures6 process7 dnsIp8 32 hurriway.xyz 188.93.233.62, 49724, 49731, 80 NETSOLUTIONSNL Portugal 11->32 34 192.168.2.1 unknown unknown 11->34 16 C:\Users\user\AppData\...\vcruntime140.dll, PE32 11->16 dropped 18 C:\Users\user\AppData\Local\...\ucrtbase.dll, PE32 11->18 dropped 20 C:\Users\user\AppData\Local\...\softokn3.dll, PE32 11->20 dropped 22 45 other files (none is malicious) 11->22 dropped 52 Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc) 11->52 54 Tries to steal Instant Messenger accounts or passwords 11->54 56 Tries to steal Mail credentials (via file access) 11->56 58 2 other signatures 11->58 file9 signatures10
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/cb34bcf1043d10a15d4a823fe188296e161b88b630f090c8dc644de84b6105ae/
Threat name:
Win32.Infostealer.BestaFera
Create hunting rule
Status:
Malicious
First seen:
2021-01-14 06:55:10 UTC
AV detection:
13 of 46 (28.26%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=zm2lz4iehuikcxkkqi76dcbjnylbxcfwgdyjbsg4mrg6qs3bawxa._file
Verdict:
malicious
Label(s):
azorult
Create hunting rule
Similar samples:
2dae80e04d518be8a6e1659d53afd6aea2eecc35086db46b4dd0a701a4b6f812
AZORult
308c96557c6be5d4519ba4bac38c23e611c7b61683cfc1063a6009e216c24f5e
AZORult
4f197c8bdfa89d2a0d041b47dabf307cba6c3deb639134357e0bfee3bf28645f
AZORult
62173847065d1aa1b93254e623844a1f223a4df4a06499f21b64fe82389fb327
AZORult
8333ba5146dd7f8dde824afe13e0bf988566027dbfcf239f06fd709115db68d7
AZORult
8abbd310dd3e242c31380c26ea16e9ac6380ac3cf53ad94fa368a70fa419abbf
AZORult
b33a22daaca745cab65dff2ca6043d40fcf67c5216feb9de1648abce9e1a8d66
AZORult
c63d4581dbe839bdb9865bcb6033e9e0ef459d1c5406e9f4fd3a05f48b46d0f1
AZORult
c8dda41b34e9b16da333bfa30653a6f46be67c657158ecfd2c0463903b01e54d
AZORult
f09dc0b3275b4c1e3a616911805011c2871af1407599493dc980b6987cb313eb
AZORult
+ 787 additional samples on MalwareBazaar
Result
Malware family:
modiloader
Create hunting rule
Score:
  10/10
Tags:
family:azorult family:modiloader infostealer trojan
Link:
https://tria.ge/reports/210114-mh6fxdkk2s/
Behaviour
Checks processor information in registry
Modifies system certificate store
Script User-Agent
Suspicious behavior: EnumeratesProcesses
Suspicious use of WriteProcessMemory
JavaScript code in executable
Loads dropped DLL
Azorult
Unpacked files
SH256 hash:
cb34bcf1043d10a15d4a823fe188296e161b88b630f090c8dc644de84b6105ae
MD5 hash:
48ca734044cf115b599af5dc400c5fb1
SHA1 hash:
1e38e234ff91a79733f960fba17972cc956d4074
Link:
https://www.unpac.me/results/2f83d9aa-5651-4050-9553-729f32cdfc1d/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Kryptik
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/cb34bcf1043d10a15d4a823fe188296e161b88b630f090c8dc644de84b6105ae

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AZORult

rar d50611afdf812fc142bef9710d5a974cc599454a699a0f99476ef7a793b2dc14

AZORult

Executable exe cb34bcf1043d10a15d4a823fe188296e161b88b630f090c8dc644de84b6105ae

(this sample)

  
Dropped by
MD5 c6540e8eebc17209f46d87525471a0ec
  
Delivery method
Distributed via e-mail attachment
  
Dropped by
SHA256 d50611afdf812fc142bef9710d5a974cc599454a699a0f99476ef7a793b2dc14
Cape
Cape
https://www.capesandbox.com/analysis/111936/

Comments