MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 d8b589a43f9499ffec0bc949540579b25a1c333d6e0531c7f40336e720e04a6b. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

AZORult

Vendor detections: 7

Intelligence 7 IOCs YARA 1 File information Comments

SHA256 hash:	d8b589a43f9499ffec0bc949540579b25a1c333d6e0531c7f40336e720e04a6b
SHA3-384 hash:	3e443393a416f3cad6de8f5c9e93d971b956a1df1c213992cbdb82e8c4804710b1e9aa73eff4bc0d30af3fa88afe1a13
SHA1 hash:	3f3cbe4fde7b2d46e0d269156abccb1dd86e69c8
MD5 hash:	20f650e0c6ca5d190d9ca4b2ae9823b5
humanhash:	mississippi-yellow-stream-sink
File name:	Ref scan_10_020.exe
Download:	download sample
Signature	AZORult Create hunting rule
File size:	2'462'720 bytes
First seen:	2020-10-12 14:46:34 UTC
Last seen:	2020-10-12 16:16:20 UTC
File type:	exe
MIME type:	application/x-dosexec
imphash	f34d5f2d4577ed6d9ceec516c1f5a744 (48'741 x AgentTesla, 19'606 x Formbook, 12'242 x SnakeKeylogger)
ssdeep	49152:sxuPEP9XDSjPeAoE4vFnsAnr/3hMp66f+iIoNHRB7J:dPEP9zS6Ao/s8rU7DNHRB7J
Threatray	4 similar samples on MalwareBazaar
TLSH	4DB522FB32681E87C9EE3CF5A052558043FA264369FDE7C4ACC660EF49D6F46069058B
Reporter	abuse_ch
Tags:	AZORult exe

abuse_ch

Malspam distributing unidentified malware:

From: Financial Manager <ptl@crrt.uz>
Subject: Editing Remittance Form
Attachment: Ref scan_10_020.iso (contains "Ref scan_10_020.exe")

Intelligence

File Origin

# of uploads :

# of downloads :

186

Origin country :

n/a

Vendor Threat Intelligence

Detection:

n/a

Link:

https://www.capesandbox.com/analysis/70126/

Detection(s):

SecuriteInfo.com.BehavesLike.Win32.Generic.vc.30321.UNOFFICIAL

Result

Verdict:

Malware

Maliciousness:

Behaviour

Creating a window

Sending a UDP request

Unauthorized injection to a recently created process

Creating a file

Blocking the User Account Control

Result

Threat name:

AgentTesla

Detection:

malicious

Classification:

troj.evad

Score:

80 / 100

Link:

https://www.joesandbox.com/analysis/488580

Signature

.NET source code contains potential unpacker

Injects a PE file into a foreign processes

Machine Learning detection for sample

Multi AV Scanner detection for submitted file

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Yara detected AgentTesla

Yara detected AntiVM_3

Behaviour

Behavior Graph:

Download SVG

Detection:

azorult

Link:

https://mwdb.cert.pl/sample/d8b589a43f9499ffec0bc949540579b25a1c333d6e0531c7f40336e720e04a6b/

Threat name:

ByteCode-MSIL.Spyware.Noon

Status:

Malicious

First seen:

2020-10-12 13:38:11 UTC

File Type:

PE (.Net Exe)

Extracted files:

AV detection:

24 of 29 (82.76%)

Threat level:

2/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=3c2ytjb7ssm773alzfeviblzwjnbymz5nyctdr7uam3ooihajjvq._file

Verdict:

unknown

AZORult

371f46d6159d5fcba2d1531a470938fcd195840aeaf1147ec894407a7387431d

AZORult

7775bf665391c8e930e16cdb4b1a78458ffe7e662a099376050d425a8c24637e

AZORult

d68a5a2bf92f0f08b8eb6f39351462f81d65d54085c1c7ae3aa81b2d3018434e

AZORult

Result

Malware family:

n/a

Score:

10/10

Tags:

evasion trojan

Link:

https://tria.ge/reports/201012-en2eqvpaxx/

Behaviour

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

System policy modification

Suspicious use of SetThreadContext

Checks whether UAC is enabled

UAC bypass

Unpacked files

SH256 hash:

d8b589a43f9499ffec0bc949540579b25a1c333d6e0531c7f40336e720e04a6b

MD5 hash:

20f650e0c6ca5d190d9ca4b2ae9823b5

SHA1 hash:

3f3cbe4fde7b2d46e0d269156abccb1dd86e69c8

Link:

https://www.unpac.me/results/178620fa-3c37-459b-8cb8-728aed42af88/

SH256 hash:

d956fa6f06e140b441a2f69736334992fe5f14710e93254f3b356684a05e91d8

MD5 hash:

6ef16b9eb7b2ffa34ef1ef7d8285d089

SHA1 hash:

f24531b94b37ab1d19fb4951961777e11adb4fe3

Link:

https://www.unpac.me/results/178620fa-3c37-459b-8cb8-728aed42af88/

SH256 hash:

9361b2a83d94f6e0e149cff3935e2c9ecb8ee63091cc06e91925bdfbd43d05c4

MD5 hash:

2f1449da083d6380fa033c60bb7d4e75

SHA1 hash:

3948461e602390e23dc11339bab4cd6d645525dc

Link:

https://www.unpac.me/results/178620fa-3c37-459b-8cb8-728aed42af88/

SH256 hash:

af42fa6663ce3d49fc2a3c629033e3fe2896bafe2ef54b1ddea1f25b5494c38f

MD5 hash:

e57e64fc92672377caad91aca90851ca

SHA1 hash:

52eff77000fad6f027d310c7b6c3e70060ceaf2a

Link:

https://www.unpac.me/results/178620fa-3c37-459b-8cb8-728aed42af88/

SH256 hash:

607f04646c9f16f7c23fa69d4b8f660fc7c44d40e4f73a0c70a2b315debdaa8b

MD5 hash:

a90baadadf904455325f7bc787185c7b

SHA1 hash:

7d833bb819d638008c98be469b05db2feaf201cd

Link:

https://www.unpac.me/results/178620fa-3c37-459b-8cb8-728aed42af88/

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Trojan

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/d8b589a43f9499ffec0bc949540579b25a1c333d6e0531c7f40336e720e04a6b

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.