MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 e9c42b737c586759102817b5922701598ec9c9256b36cf5fc28782fa09016ca4. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AZORult


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: e9c42b737c586759102817b5922701598ec9c9256b36cf5fc28782fa09016ca4
SHA3-384 hash: 38180a7605152fe95758aa5f4bca5d2dea386e3ac0885fc4e4cba31c0a44e1889427f3007ac0d269b5b3f095d62a45dc
SHA1 hash: b1c822950c670bf814a0d5683c2a4b6107a7a537
MD5 hash: 39f0b06bbcd289f628443a16ea7d782d
humanhash: kansas-lemon-iowa-yellow
File name:e9c42b737c586759102817b5922701598ec9c9256b36cf5fc28782fa09016ca4
Download: download sample
Signature AZORult
Create hunting rule
File size:541'184 bytes
First seen:2020-03-23 16:23:44 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash 54b262fcc1f097cf4c87295a213868c7 (1 x AZORult)
ssdeep 12288:TwRVqGpdh4kyfq7HG5hEwpwcDfaTxK6eeyYHtcJYJx6KZ:TiVD/49fqKowrza1K6e6iJYJJZ
Threatray 278 similar samples on MalwareBazaar
TLSH 75B49E36F6D04533E1232539DC4B5265A52ABED0292819B72FE92C886FF9B8135373D3
Reporter Marco_Ramilli
Tags:AZORult exe

Intelligence

File Origin
# of uploads :
1
# of downloads :
81
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
PUA.Win.Packer.BorlandDelphi-1
Create hunting rule

Win.Trojan.Agent-7107886-0
Create hunting rule

PUA.Win.Adware.Slugin-6803969-0
Create hunting rule

PUA.Win.Adware.Slugin-6840354-0
Create hunting rule

PUA.Win.Adware.Webalta-6912039-0
Create hunting rule

Gathering data
Threat name:
Win32.Trojan.Injector
Create hunting rule
Status:
Malicious
First seen:
2019-08-09 15:30:40 UTC
AV detection:
27 of 30 (90.00%)
Threat level:
  5/5
Verdict:
malicious
Label(s):
azorult
Create hunting rule
Similar samples:
0030717c09c6bcbe9db0f9837ac85415e0bc3762ec9a8f131f7f6920193582a3
AZORult
28558516b6b4912e36105c566322d9e4a47a0fca0847c55227683c51834e98e9
AZORult
59e39b6123ed1218d7ae3b4406b3e06c1fc84ecb8fafad05e762b9867c77248b
AZORult
6a0a4894127b64d80992079cbcce8ab2b6998e65ac8dca03259697db83dc9332
AZORult
7f6bc984038905de70fa3580480df8297dbaf3eabb971fa949550a99641e56cb
AZORult
7fb195bc96bd220998dd778dd9e6fcb70320102bbb8656d4c765800ad8d9bb83
AZORult
8480058fc20ebfef47d1ebccbb54b88f656715b99c2d4e80ad46b05906ff4dbe
AZORult
c82a750c5a0dcc2a923f97b3bfbba13fd302144fdcdab020f7c7c94e24892807
AZORult
ce974c7e36a7933cdac1489c1b338eeabc04f0f418a67983012258ec914ec4ec
AZORult
dc9b22b1af973bd12495cfd6e2c6621eb21e347a3f6a32edafb823a91d4e721a
AZORult
+ 268 additional samples on MalwareBazaar
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

AZORult

Executable exe e9c42b737c586759102817b5922701598ec9c9256b36cf5fc28782fa09016ca4

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/223292/
  
Delivery method
Distributed via web download

BLint

The following table provides more information about this file using BLint. BLint is a Binary Linter to check the security properties, and capabilities in executables.

Findings
IDTitleSeverity
CHECK_AUTHENTICODEMissing Authenticodehigh
CHECK_NXMissing Non-Executable Memory Protectioncritical
CHECK_PIEMissing Position-Independent Executable (PIE) Protectionhigh
Reviews
IDCapabilitiesEvidence
WIN32_PROCESS_APICan Create Process and Threadskernel32.dll::CloseHandle
kernel32.dll::CreateThread
WIN_BASE_APIUses Win Base APIkernel32.dll::LoadLibraryExA
kernel32.dll::LoadLibraryA
kernel32.dll::GetSystemInfo
kernel32.dll::GetStartupInfoA
kernel32.dll::GetDiskFreeSpaceA
kernel32.dll::GetCommandLineA
WIN_BASE_IO_APICan Create Fileskernel32.dll::CreateFileA
kernel32.dll::FindFirstFileA
WIN_REG_APICan Manipulate Windows Registryadvapi32.dll::RegOpenKeyExA
advapi32.dll::RegQueryValueExA
WIN_USER_APIPerforms GUI Actionsuser32.dll::ActivateKeyboardLayout
user32.dll::CreateMenu
user32.dll::FindWindowA
user32.dll::PeekMessageA
user32.dll::CreateWindowExA

Comments