MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 d8c4fb5e1c854c9362c4129efbaa6b72435b8e93df66fd418f288650d360ff22. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AZORult


Vendor detections: 12


Intelligence 12 IOCs YARA 2 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: d8c4fb5e1c854c9362c4129efbaa6b72435b8e93df66fd418f288650d360ff22
SHA3-384 hash: 26760d4460402f65e7a6ce220250b699bc973d4d8707b8dd9b2bbc4e08b5f5a27c9bc686045398c1c5e817feca4f04c8
SHA1 hash: 7654636d4ea487f5e91f190e5027567b1100de63
MD5 hash: 47f8484ec477d3e4a22ac8a93c20653f
humanhash: zulu-illinois-ack-carbon
File name:kendrickzx.exe
Download: download sample
Signature AZORult
Create hunting rule
File size:848'896 bytes
First seen:2022-02-14 16:10:13 UTC
Last seen:2022-02-14 17:36:11 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'649 x AgentTesla, 19'454 x Formbook, 12'202 x SnakeKeylogger)
ssdeep 24576:Z7gp1knvMcGaVapOkYfPlP3jojhTPE01kGG:Z7GcGgapOnd0PEckGG
Threatray 1'265 similar samples on MalwareBazaar
TLSH T146050101779A7B17C97E0F7BD9A1420247B4E95A911BD73B68C036EC2C8B3941E7227B
File icon (PE):PE icon
dhash icon b3b3333969693b3b (69 x Formbook, 63 x AgentTesla, 26 x Loki)
Reporter pr0xylife
Tags:AZORult exe

Intelligence

File Origin
# of uploads :
2
# of downloads :
319
Origin country :
n/a
Vendor Threat Intelligence
Detection:
Azorult
Create hunting rule
Link:
https://www.capesandbox.com/analysis/241425/
Detection(s):
SecuriteInfo.com.Trojan.PWS.Steam.25605.24643.28324.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Searching for the window
Creating a window
Sending a custom TCP request
Creating a file in the %temp% directory
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
azorult control.exe obfuscated packed
Link:
https://www.filescan.io/uploads/620a7eeb289e2f3e4fda02d8/reports/7a2d3819-131b-4ba8-a1a0-64e82d79b431/overview
Result
Verdict:
UNKNOWN
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
AZORult
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/5c836307-54a8-4d75-8901-ef383a966720
Result
Threat name:
Azorult
Create hunting rule
Detection:
malicious
Classification:
phis.troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/939522
Signature
.NET source code contains potential unpacker
Antivirus detection for URL or domain
C2 URLs / IPs found in malware configuration
Found malware configuration
Found many strings related to Crypto-Wallets (likely being stolen)
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for domain / URL
Multi AV Scanner detection for submitted file
Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Tries to harvest and steal Bitcoin Wallet information
Tries to harvest and steal browser information (history, passwords, etc)
Tries to harvest and steal ftp login credentials
Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)
Tries to steal Crypto Currency Wallets
Tries to steal Instant Messenger accounts or passwords
Tries to steal Mail credentials (via file / registry access)
Yara detected AntiVM3
Yara detected Azorult
Yara detected Azorult Info Stealer
Behaviour
Behavior Graph:
Download SVG
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/d8c4fb5e1c854c9362c4129efbaa6b72435b8e93df66fd418f288650d360ff22/
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2022-02-14 16:11:10 UTC
File Type:
PE (.Net Exe)
Extracted files:
8
AV detection:
21 of 28 (75.00%)
Threat level:
  5/5
Verdict:
malicious
Label(s):
azorult
Create hunting rule
Similar samples:
10fed6bb7e0d98d4c39fecce52838efecad2e6d836ceabaf40b438e6790e8abf
AZORult
9bceb9680d39094087add5289a7e19aa93168faf9c5f2465700b117d59e8d841
AZORult
a3c57266f4f2f229c35a60c0c07914b8029d22f4e258288b296b3e2669e1d566
AZORult
bc297a5178f17d2b1f7c69649155df74086c99486c2caa5a1117fd45f52f41fa
AZORult
d1fea52507fc97ff419f8dd2ea8ecf689fb7c066cf8f18453378e95bf399c3d6
AZORult
ee643573b6c459331e833e00629da9643b47da0f661a82020dd2c0db5ccfa259
AZORult
fd5e6989ff1e8e4ef24bbb2b67018ef8adbdf0da5d489cd142fd8e1a033ce92e
AZORult
+ 1'255 additional samples on MalwareBazaar
Result
Malware family:
azorult
Create hunting rule
Score:
  10/10
Tags:
family:azorult collection discovery infostealer spyware stealer trojan
Link:
https://tria.ge/reports/220214-tmx2naaac4/
Behaviour
Checks processor information in registry
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
outlook_office_path
outlook_win_path
Drops file in Windows directory
Suspicious use of SetThreadContext
Accesses Microsoft Outlook profiles
Accesses cryptocurrency files/wallets, possible credential harvesting
Checks installed software on the system
Loads dropped DLL
Reads data files stored by FTP clients
Reads local data of messenger clients
Reads user/profile data of local email clients
Reads user/profile data of web browsers
Azorult
Malware Config
C2 Extraction:
http://australiadish.bar/kendrick/index.php
Unpacked files
SH256 hash:
658c80f34df29800e29a4112d11cda1f861c5622cff223d43c026ee191473fc0
MD5 hash:
024c4790ae1fee2b1280f5b26da2bc6b
SHA1 hash:
e9e34165a3ffaad39aaec159387b333f3cff378a
Detections:
win_azorult_g1
Create hunting rule
win_azorult_auto
Create hunting rule
Link:
https://www.unpac.me/results/07db5a3d-01de-4e3e-8bc3-5556ad7dd25d/
Parent samples :
3ca1b9b8c365e7329e540d4e84320f0bf61e50a4bab5be54460d0c3e2f320ce1
fd5e6989ff1e8e4ef24bbb2b67018ef8adbdf0da5d489cd142fd8e1a033ce92e
10fed6bb7e0d98d4c39fecce52838efecad2e6d836ceabaf40b438e6790e8abf
d8c4fb5e1c854c9362c4129efbaa6b72435b8e93df66fd418f288650d360ff22
fb253ba653005c97ec369d37d3ef234e85989984c77296bc8f763b53cbb07ab9
f188d2c47c9f395e6063a2fe69edf5830c4d520e11f21421a1814d3202503c45
85e16c4fe21b79d748d246527b80cacb62c90b75f331e774d7cef90d3f3764f5
5c52d01a13034d617c28365f534c392ec264c3d755dc36ff188082081af05688
SH256 hash:
3ca74eb4ce4c2c5604dc298949ae47996d93063abfde0682d689205561d17d44
MD5 hash:
4e35b541f3d9162d0ac93d336df67779
SHA1 hash:
bb9e65761186806d4bada659e9d5db0c070501d4
Link:
https://www.unpac.me/results/07db5a3d-01de-4e3e-8bc3-5556ad7dd25d/
SH256 hash:
3694e7d02d1eec74388bd7d0d2483214759860ec527bc707e8c85a5da5253bb3
MD5 hash:
4fc82a0076f6e412dfd5406fd93aaa5c
SHA1 hash:
9156f5cd2d4a790be1a706875cde4660b1dc000a
Link:
https://www.unpac.me/results/07db5a3d-01de-4e3e-8bc3-5556ad7dd25d/
SH256 hash:
6f9666f201256f7447d8af2a4f398c18f7c5e2460012828d2c9a9b93545618a1
MD5 hash:
9333ef8644bc60a82b355e8a4a0b9912
SHA1 hash:
3930c4a1f792e42a63f5f73fdde4389e42ca280f
Link:
https://www.unpac.me/results/07db5a3d-01de-4e3e-8bc3-5556ad7dd25d/
SH256 hash:
d8c4fb5e1c854c9362c4129efbaa6b72435b8e93df66fd418f288650d360ff22
MD5 hash:
47f8484ec477d3e4a22ac8a93c20653f
SHA1 hash:
7654636d4ea487f5e91f190e5027567b1100de63
Link:
https://www.unpac.me/results/07db5a3d-01de-4e3e-8bc3-5556ad7dd25d/
Malware family:
AZORult v3
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/d8c4fb5e1c85/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/d8c4fb5e1c854c9362c4129efbaa6b72435b8e93df66fd418f288650d360ff22

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:pe_imphash
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

AZORult

Executable exe d8c4fb5e1c854c9362c4129efbaa6b72435b8e93df66fd418f288650d360ff22

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/2038758/
  
Delivery method
Distributed via web download
Cape
Cape
https://www.capesandbox.com/analysis/241425/

Comments