MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 cc3cc2b2f00b65d6d83cfcbe21722f8bddbfacbe6fa06452fd6dc9d407bcb3c2. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AZORult


Vendor detections: 7


Intelligence 7 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: cc3cc2b2f00b65d6d83cfcbe21722f8bddbfacbe6fa06452fd6dc9d407bcb3c2
SHA3-384 hash: ec26544d70610a994eee1e0ffcdc41d4c4943fb39370def0466e2337aad33e9e30399d9cbf09b566aac2458795abc611
SHA1 hash: ac57beaa9a1a7ed048a57949143115cb53990ea1
MD5 hash: 921ca5ce444e4fd3f75c5185a9ce226d
humanhash: six-fruit-michigan-five
File name:DELHI-Aircraft- airline spares purchase order-Specifications.rar
Download: download sample
Signature AZORult
Create hunting rule
File size:510'034 bytes
First seen:2022-03-15 07:55:20 UTC
Last seen:Never
File type: rar
MIME type:application/x-rar
ssdeep 12288:Bn7kL7rKlYZZ7b/qMLKIUPCqT/Zp93qr3SFC1NDIph0:hM7rADLdo3tIX0
TLSH T13CB4232DA35CC7A79D4B25D3D0E53B2FD0CC6D926CE60EB4103AD4E3F99126856AB18C
Reporter cocaman
Tags:AZORult rar


Avatar
cocaman
Malicious email (T1566.001)
From: "ROC - DELHI<mayrauizl94@gmail.com>" (likely spoofed)
Received: "from gmail.com (unknown [31.210.20.90]) "
Date: "15 Mar 2022 05:30:40 +0100"
Subject: "ROC - DELHI-Aircraft Parts, SPARES PURCHASE ORDER SPECIFICATION FROM lgpartner.ch.. Date: Am3/15/2022 5:30:39 a.m. Time: 3/15/2022 5:30:39 a.m."
Attachment: "DELHI-Aircraft- airline spares purchase order-Specifications.rar"

Intelligence

File Origin
# of uploads :
1
# of downloads :
466
Origin country :
n/a
Vendor Threat Intelligence
Verdict:
Suspicious
Threat level:
  5/10
Confidence:
100%
Tags:
control.exe overlay packed shell32.dll
Link:
https://www.filescan.io/uploads/62304696b94fb38cb482a1ae/reports/ac53b8a1-13d0-4748-9272-35f066aae431/overview
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/cc3cc2b2f00b65d6d83cfcbe21722f8bddbfacbe6fa06452fd6dc9d407bcb3c2/
Threat name:
Win32.Trojan.FormBook
Create hunting rule
Status:
Malicious
First seen:
2022-03-15 07:56:12 UTC
File Type:
Binary (Archive)
Extracted files:
5
AV detection:
19 of 27 (70.37%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=zq6mfmxqbns5nwb47s7cc4rprpo37lf6n6qgiux5nxe5ib54wpba._file
Result
Malware family:
azorult
Create hunting rule
Score:
  10/10
Tags:
family:azorult collection discovery infostealer spyware stealer trojan
Link:
https://tria.ge/reports/220315-jspx5ahah7/
Behaviour
Checks processor information in registry
Suspicious behavior: EnumeratesProcesses
Suspicious use of WriteProcessMemory
outlook_office_path
outlook_win_path
Enumerates physical storage devices
Program crash
Accesses Microsoft Outlook profiles
Accesses cryptocurrency files/wallets, possible credential harvesting
Checks installed software on the system
Loads dropped DLL
Reads data files stored by FTP clients
Reads local data of messenger clients
Reads user/profile data of local email clients
Reads user/profile data of web browsers
Executes dropped EXE
Azorult
Malware Config
C2 Extraction:
http://89.43.107.198/mpom/index.php
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/cc3cc2b2f00b65d6d83cfcbe21722f8bddbfacbe6fa06452fd6dc9d407bcb3c2

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AZORult

rar cc3cc2b2f00b65d6d83cfcbe21722f8bddbfacbe6fa06452fd6dc9d407bcb3c2

(this sample)

AZORult

Executable exe b05adf9ad869adb1c7605901185d74da4ccc5ad49106044a1114cbae8908713a

  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 b05adf9ad869adb1c7605901185d74da4ccc5ad49106044a1114cbae8908713a

Comments