MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 fdc67fedfe7d517e76232c036cd8b77e80e5c32e5214dd0a606062cb06460b66. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AZORult


Vendor detections: 10


Intelligence 10 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: fdc67fedfe7d517e76232c036cd8b77e80e5c32e5214dd0a606062cb06460b66
SHA3-384 hash: 28dba47c0fcdb28236acf6a85c3f5782130c410201a80570365a17a56cdfa6f68708cd99720ee291ae1f9504d98e6622
SHA1 hash: 626c4850ee7c348ebbd00d0ee748920a8150291f
MD5 hash: d5e81cac610e6928283350bb3f4d7d7b
humanhash: angel-april-bluebird-mars
File name:SecuriteInfo.com.Trojan.PWS.Siggen2.60564.30009.9519
Download: download sample
Signature AZORult
Create hunting rule
File size:398'336 bytes
First seen:2020-12-01 16:52:02 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'742 x AgentTesla, 19'607 x Formbook, 12'242 x SnakeKeylogger)
ssdeep 12288:7jUxKwf1FtRWZ0cbt23vsSElB0s8X+RW/FbLjBIw0sT:7gDt4RhNSe0XORWN5
Threatray 435 similar samples on MalwareBazaar
TLSH E884F19CB65471DFC427D876CBA82C64A66164BF831F9303A41322EE9D4DA9BCF450F2
Reporter SecuriteInfoCom
Tags:AZORult

Intelligence

File Origin
# of uploads :
1
# of downloads :
295
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/106274/
Detection(s):
SecuriteInfo.com.Trojan.PWS.Siggen2.60564.30009.9519.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Sending a UDP request
Creating a window
Unauthorized injection to a recently created process
Creating a file
Sending an HTTP POST request
Creating a file in the %temp% subdirectories
Deleting a recently created file
Reading critical registry keys
Stealing user critical data
Result
Verdict:
SUSPICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Result
Threat name:
AZORult
Create hunting rule
Detection:
malicious
Classification:
phis.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/552674
Signature
Binary contains a suspicious time stamp
Detected AZORult Info Stealer
Detected unpacking (changes PE section rights)
Found many strings related to Crypto-Wallets (likely being stolen)
Injects a PE file into a foreign processes
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for submitted file
PE file contains section with special chars
PE file has nameless sections
Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Tries to harvest and steal browser information (history, passwords, etc)
Tries to harvest and steal ftp login credentials
Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)
Tries to steal Instant Messenger accounts or passwords
Tries to steal Mail credentials (via file access)
Yara detected AntiVM_3
Yara detected Azorult
Yara detected Azorult Info Stealer
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 325436 Sample: SecuriteInfo.com.Trojan.PWS... Startdate: 01/12/2020 Architecture: WINDOWS Score: 100 29 Snort IDS alert for network traffic (e.g. based on Emerging Threat rules) 2->29 31 Malicious sample detected (through community Yara rule) 2->31 33 Multi AV Scanner detection for submitted file 2->33 35 9 other signatures 2->35 6 SecuriteInfo.com.Trojan.PWS.Siggen2.60564.30009.exe 3 2->6         started        process3 file4 17 SecuriteInfo.com.T...60564.30009.exe.log, ASCII 6->17 dropped 37 Detected unpacking (changes PE section rights) 6->37 39 Detected AZORult Info Stealer 6->39 41 Injects a PE file into a foreign processes 6->41 10 SecuriteInfo.com.Trojan.PWS.Siggen2.60564.30009.exe 62 6->10         started        15 SecuriteInfo.com.Trojan.PWS.Siggen2.60564.30009.exe 6->15         started        signatures5 process6 dnsIp7 27 158.101.98.57, 49729, 49732, 80 ORACLE-BMC-31898US United States 10->27 19 C:\Users\user\AppData\...\vcruntime140.dll, PE32 10->19 dropped 21 C:\Users\user\AppData\Local\...\ucrtbase.dll, PE32 10->21 dropped 23 C:\Users\user\AppData\Local\...\softokn3.dll, PE32 10->23 dropped 25 45 other files (none is malicious) 10->25 dropped 43 Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc) 10->43 45 Tries to steal Instant Messenger accounts or passwords 10->45 47 Tries to steal Mail credentials (via file access) 10->47 49 2 other signatures 10->49 file8 signatures9
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/fdc67fedfe7d517e76232c036cd8b77e80e5c32e5214dd0a606062cb06460b66/
Threat name:
ByteCode-MSIL.Backdoor.NanoCore
Create hunting rule
Status:
Malicious
First seen:
2020-11-29 17:55:32 UTC
AV detection:
25 of 29 (86.21%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=7xdh73p6pvix45rdfqbwzwfxp2aolqzokikn2ctambrmwbsgbnta._file
Verdict:
malicious
Label(s):
azorult
Create hunting rule
Similar samples:
4551d06a33be96c8808d2e180d6cf35c50cbf2dc114a51e90aa49bb4597e2936
AZORult
62ddfbbb9039c0671aa08af5d0fdd0fe949eb96e435c631a57e931e4b19743a9
AZORult
655455e4c04c7fd6e624b752797305264093264c08b0ab45ebfceee5f7abbc66
AZORult
84f409f8aee0cf253fba68ae4027348449045f7bfb8723ac8fe0336c21c0b0f6
AZORult
886cec0fe0e68cd029b2f082e65009e46205d4f4fefa5d70923031ab5982fbc1
AZORult
aee6577ef4a0d538fecd2596cedc2cdcd8eed86e9267c1bb40b0a17fbb5e51a3
AZORult
af80a0ec35e2521f9bcb52dadbf60329d28aafa5f311c612721da30329fd57eb
AZORult
bca4b6e9f14cb4d84674d2f4db286e0ea692f68e8b1d906d04ced807556c6174
AZORult
ce06efe2c18c75da9d9535b4328677f4136a3f04ea666d037bf55dce7c9b7c57
AZORult
e53cd448b2fad21583ddd160f9b6cdfacbec7a8c9c7ae9712c4c39972daa4c18
AZORult
+ 425 additional samples on MalwareBazaar
Result
Malware family:
azorult
Create hunting rule
Score:
  10/10
Tags:
family:azorult discovery infostealer spyware trojan
Link:
https://tria.ge/reports/201201-tav9n69gdn/
Behaviour
Checks processor information in registry
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Suspicious use of SetThreadContext
Checks installed software on the system
JavaScript code in executable
Loads dropped DLL
Reads data files stored by FTP clients
Reads user/profile data of local email clients
Reads user/profile data of web browsers
Azorult
Malware Config
C2 Extraction:
http://158.101.98.57/index.php
Unpacked files
SH256 hash:
fdc67fedfe7d517e76232c036cd8b77e80e5c32e5214dd0a606062cb06460b66
MD5 hash:
d5e81cac610e6928283350bb3f4d7d7b
SHA1 hash:
626c4850ee7c348ebbd00d0ee748920a8150291f
Link:
https://www.unpac.me/results/83687ad3-28a6-4966-8901-38ae43774ead/
SH256 hash:
cb951f1d2b5460456aad0d89cef1216d9be5e51784d11a92447d43e96177bd5e
MD5 hash:
8cd5d2014866f4ef60802ff1826998a6
SHA1 hash:
8ff75946905d0b117080cc5a07e6e0bbea4e9bbd
Link:
https://www.unpac.me/results/83687ad3-28a6-4966-8901-38ae43774ead/
SH256 hash:
2b9f694e7b9450b9960c227858c0ec901d79b56de168374c2aaf7ce2d927d7a7
MD5 hash:
99a0b33a7cfc78c290e563aeb34eb6a5
SHA1 hash:
c70d567dd8038868f1e8374520dfad6b95cdb5bf
Detections:
win_azorult_g1
Create hunting rule
win_azorult_auto
Create hunting rule
Link:
https://www.unpac.me/results/83687ad3-28a6-4966-8901-38ae43774ead/
Parent samples :
fdc67fedfe7d517e76232c036cd8b77e80e5c32e5214dd0a606062cb06460b66
5870ba9274f3eac3690f01c263c104de1a1729075b03e666d175cbf1fdd9b8cb
ee0fc921e6afbab3b831c73d06b39c933ba99e64b4156cb69c627b1561431af0
bb50ec005b943e5906c449de4b21d1d6f7f2b5b377f01886032c576cfacca298
SH256 hash:
a4d39fd65e606e94adaf7082ac0d2e774964a664c04dcbaf73fca0141fa630a0
MD5 hash:
308f8c952a270850f64b27056aeab22c
SHA1 hash:
eab3d0eeb917bcabec096fc3140c65339721a149
Link:
https://www.unpac.me/results/83687ad3-28a6-4966-8901-38ae43774ead/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
AgentTesla
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/fdc67fedfe7d517e76232c036cd8b77e80e5c32e5214dd0a606062cb06460b66

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

AZORult

Executable exe fdc67fedfe7d517e76232c036cd8b77e80e5c32e5214dd0a606062cb06460b66

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/879626/
  
Delivery method
Distributed via web download
Cape
Cape
https://www.capesandbox.com/analysis/106274/

Comments