🤲🏼 NEW | abuse.ch Community Hub! Earn recognition 🏅 for the malware intelligence you share, climb the leaderboards 📈, and connect with like-minded contributors who share your hunting focus 🤝. Ready to unlock your profile? Go to the Community Hub →

MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 f0fa8732973493f86e5f30ed0458d97c52e4d38452dcbd57b1dbb2ebf4663c3c. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AZORult


Vendor detections: 7


Intelligence 7 IOCs 5 YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: f0fa8732973493f86e5f30ed0458d97c52e4d38452dcbd57b1dbb2ebf4663c3c
SHA3-384 hash: 6a4ac10e2fd586f2968692c9880eb01a8a9d97fe5b2b3c34dc14185817e323efd19cd0e1f594ef5a2bbb5a22db28fe36
SHA1 hash: 3bb425fe8e9385dc1f7fcf21109fe5749c4f5eca
MD5 hash: 296b151c8c9979c6b9661728be0c3bb7
humanhash: lemon-beryllium-maryland-october
File name:ORDER.zip
Download: download sample
Signature AZORult
Create hunting rule
File size:206'555 bytes
First seen:2023-07-04 08:52:12 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 6144:0JdDQiHbC8MGHNvFSZojX2ZYVu0g96MpJyhUVt:i5HgKmZkut9/Dt
TLSH T15B1413B07903671765B6E5E725C34F3478307D236CA922C136382CEF91A0ABE66F5885
TrID 80.0% (.ZIP) ZIP compressed archive (4000/1)
20.0% (.PG/BIN) PrintFox/Pagefox bitmap (640x800) (1000/1)
Reporter TeamDreier
Tags:AZORult zip

Indicators Of Compromise (IOCs)

Below is a list of indicators of compromise (IOCs) associated with this malware samples.

IOCThreatFox Reference
109.206.242.32:3078 https://threatfox.abuse.ch/ioc/1135740/
http://109.206.242.32/index.php https://threatfox.abuse.ch/ioc/1135743/
http://109.206.242.32:5353/is-ready https://threatfox.abuse.ch/ioc/1135744/
http://109.206.242.32:5353/moz-sdk https://threatfox.abuse.ch/ioc/1135745/
109.206.242.32:5353 https://threatfox.abuse.ch/ioc/1135744/

Intelligence

File Origin
# of uploads :
1
# of downloads :
108
Origin country :
DK DK
File Archive Information

This file archive contains 1 file(s), sorted by their relevance:

File name:ORDER.js
File size:934'778 bytes
SHA256 hash: a0041aa69a92b8a85e020dcf6424960e466c4e2f315a556bed9e06d870dddf47
MD5 hash: 70e483ab51c94cd2318fb5cb0de989fd
MIME type:text/plain
Signature AZORult
Vendor Threat Intelligence
Detection(s):
Sanesecurity.Foxhole.JS_Zip_1.UNOFFICIAL
Create hunting rule

SecuriteInfo.com.JS.Kryptik.CNJ.tr.19194.11856.UNOFFICIAL
Create hunting rule

PUA.SecuriteInfo.com.JS.Malware-1.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malicious
File Type:
JS File - Malicious
Link:
https://app.docguard.net/f0fa8732973493f86e5f30ed0458d97c52e4d38452dcbd57b1dbb2ebf4663c3c/results/dashboard
Verdict:
Suspicious
Threat level:
  5/10
Confidence:
100%
Tags:
masquerade
Link:
https://www.filescan.io/uploads/64a3ddf32299d26882649de3/reports/aa7eb805-29bc-43f8-b6f8-c5eeb8981255/overview
Verdict:
Malicious
Labled as:
Trojan.Generic
Link:
https://www.hybrid-analysis.com/sample/f0fa8732973493f86e5f30ed0458d97c52e4d38452dcbd57b1dbb2ebf4663c3c
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/f0fa8732973493f86e5f30ed0458d97c52e4d38452dcbd57b1dbb2ebf4663c3c/
Threat name:
Script-JS.Trojan.Heuristic
Create hunting rule
Status:
Malicious
First seen:
2023-07-03 01:19:49 UTC
File Type:
Binary (Archive)
Extracted files:
1
AV detection:
10 of 37 (27.03%)
Threat level:
  2/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=6d5iomuxgsj7q3s7gdwqiwgzprjoju4eklol2v5r3ozox5dghq6a._file
Result
Malware family:
strrat
Create hunting rule
Score:
  10/10
Tags:
family:strrat persistence stealer trojan
Link:
https://tria.ge/reports/230704-l984fabh52/
Behaviour
Creates scheduled task(s)
Suspicious use of WriteProcessMemory
Uses Task Scheduler COM API
Enumerates physical storage devices
Adds Run key to start application
Checks computer location settings
Drops startup file
Loads dropped DLL
STRRAT
Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:js_ratdispenser
Create hunting rule
Author:HP Threat Research @HPSecurity
Description:JavaScript downloader resp. dropper delivering various RATs

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AZORult

zip f0fa8732973493f86e5f30ed0458d97c52e4d38452dcbd57b1dbb2ebf4663c3c

(this sample)

  
Delivery method
Distributed via e-mail attachment

Comments