MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 e5550d60a971336699ae2ddf5a88ef9ef0e2ac8d9bae8db9ebadf8e360ad3df1. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	e5550d60a971336699ae2ddf5a88ef9ef0e2ac8d9bae8db9ebadf8e360ad3df1
SHA3-384 hash:	8e76ce4eee43f89a63e509a49bc6837e90f1cbfb375ec1cc8a8c85c99a1dc9e03cf86b6d75bcff40c6be4351b57cec2f
SHA1 hash:	e5b3a5977750cd34a69e908bf22893f153b9301f
MD5 hash:	581a2142bc26026893bbdfab4e65f694
humanhash:	friend-iowa-delta-helium
File name:	Order draft.vbs
Download:	download sample
Signature	AZORult Alert Create hunting rule
File size:	516'122 bytes
First seen:	2024-09-25 06:36:52 UTC
Last seen:	2024-10-02 03:28:48 UTC
File type:	vbs
MIME type:	text/plain
ssdeep	12288:u9M/PycpcyDgDy8f1xLWFIZni8itFw9UPpVaElOOywO5lowt4sG50v8eKjDo6c5l:S0ifJtH
TLSH	T12BB4F91135EA7008F1F32FA356FD55E94FABB9662A36912E7048074B4B93E80CE51B73
TrID	66.6% (.TXT) Text - UTF-16 (LE) encoded (2000/1) 33.3% (.MP3) MP3 audio (1000/1)
Magika	vba
Reporter	abuse_ch
Tags:	AZORult BlindEagle vbs

Intelligence

---

File Origin

# of uploads :

2

# of downloads :

143

Origin country :

NL

Vendor Threat Intelligence

ClamAV Detected

Detection(s):

SecuriteInfo.com.Script.SNH-gen.6484.12129.UNOFFICIAL

Alert

Create hunting rule

CyberFortress Malicious

Verdict:

Malicious

Score:

92.5%

Link:

https://cyber-fortress.com/docs/result/index.php?id=66f3af955346c7b922adf276

Tags:

Encryption Execution Generic Infostealer Network Stealth Gumen Lien

FileScan.IO Malicious

Verdict:

Malicious

Threat level:

  10/10

Confidence:

86%

Tags:

cscript lolbin masquerade powershell

Link:

https://www.filescan.io/uploads/66f3af93c48f81cd6a0cd57b/reports/1f6bb765-b71f-4ee7-993b-64aa18b6dad5/overview

Hybrid Analysis Unknown

Verdict:

Unknown

Link:

https://www.hybrid-analysis.com/sample/e5550d60a971336699ae2ddf5a88ef9ef0e2ac8d9bae8db9ebadf8e360ad3df1

Joe Sandbox Azorult, PureLog Stealer

Result

Threat name:

Azorult, PureLog Stealer

Alert

Create hunting rule

Detection:

malicious

Classification:

troj.spyw.expl.evad

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/1517927

Signature

AI detected suspicious sample

Antivirus detection for URL or domain

Bypasses PowerShell execution policy

C2 URLs / IPs found in malware configuration

Command shell drops VBS files

Creates autostart registry keys with suspicious values (likely registry only malware)

Found malware configuration

Found suspicious powershell code related to unpacking or dynamic code loading

Injects a PE file into a foreign processes

Malicious sample detected (through community Yara rule)

Obfuscated command line found

Sigma detected: Base64 Encoded PowerShell Command Detected

Sigma detected: HackTool - CrackMapExec PowerShell Obfuscation

Sigma detected: Potential PowerShell Command Line Obfuscation

Sigma detected: Potential PowerShell Obfuscation Via Reversed Commands

Sigma detected: PowerShell Base64 Encoded FromBase64String Cmdlet

Sigma detected: PowerShell Base64 Encoded Invoke Keyword

Sigma detected: WScript or CScript Dropper

Suricata IDS alerts for network traffic

Suspicious execution chain found

Suspicious powershell command line found

VBScript performs obfuscated calls to suspicious functions

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Writes to foreign memory regions

Wscript starts Powershell (via cmd or directly)

Yara detected Azorult

Yara detected Azorult Info Stealer

Yara detected PureLog Stealer

Behaviour

Behavior Graph:

Download SVG

CERT.PL MWDB

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/e5550d60a971336699ae2ddf5a88ef9ef0e2ac8d9bae8db9ebadf8e360ad3df1/

ReversingLabs TitaniumCloud Script-WScript.Trojan.AZORult

Threat name:

Script-WScript.Trojan.AZORult

Alert

Create hunting rule

Status:

Suspicious

First seen:

2024-09-24 13:01:05 UTC

File Type:

Text (VBS)

AV detection:

5 of 38 (13.16%)

Threat level:

  5/5

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=4vkq2yfjoezwngnofxpvvchpt3yoflentoxi3oplvx4ogyfnhxyq._file

Hatching Triage azorult

Result

Malware family:

azorult

Alert

Create hunting rule

Score:

  10/10

Tags:

family:azorult collection credential_access discovery execution infostealer persistence spyware stealer trojan

Link:

https://tria.ge/reports/240925-hdgsjazhml/

Behaviour

Checks processor information in registry

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

outlook_office_path

outlook_win_path

Browser Information Discovery

Enumerates physical storage devices

System Location Discovery: System Language Discovery

Suspicious use of SetThreadContext

Accesses Microsoft Outlook profiles

Accesses cryptocurrency files/wallets, possible credential harvesting

Adds Run key to start application

Checks computer location settings

Loads dropped DLL

Reads local data of messenger clients

Unsecured Credentials: Credentials In Files

Blocklisted process makes network request

Command and Scripting Interpreter: PowerShell

Azorult

Malware Config

C2 Extraction:

http://mg5n.shop/ML341/index.php

Dropper Extraction:

https://ia600100.us.archive.org/24/items/detah-note-v/DetahNoteV.txt

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

YOROI YOMI Malicious File

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/e5550d60a971336699ae2ddf5a88ef9ef0e2ac8d9bae8db9ebadf8e360ad3df1