MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 fee418041d28861c7b1335f745efc041547e947e672aed9ff43858bb7440f701. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

AZORult

Vendor detections: 11

Intelligence 11 IOCs YARA 2 File information Comments

SHA256 hash:	fee418041d28861c7b1335f745efc041547e947e672aed9ff43858bb7440f701
SHA3-384 hash:	84adafa7a1595b4c286c62873e28fdfe9e452725a15b3fea01420f64370e335a688bf185215e6d68a8725ce54f2cdc9a
SHA1 hash:	e138d6187eb4dc8a2435c712b1768aa7993765ab
MD5 hash:	a8eac4c12b2cc2c7bc44979cd88edf24
humanhash:	oven-maine-zulu-victor
File name:	a8eac4c1_by_Libranalysis
Download:	download sample
Signature	AZORult Create hunting rule
File size:	384'000 bytes
First seen:	2021-05-24 08:03:06 UTC
Last seen:	Never
File type:	exe
MIME type:	application/x-dosexec
imphash	f34d5f2d4577ed6d9ceec516c1f5a744 (48'661 x AgentTesla, 19'474 x Formbook, 12'208 x SnakeKeylogger)
ssdeep	6144:JMXQhf/888tFyBtB6Ux3pfiDlQfJaBmcFAlQImZB+grQIvc7n8dQSOALR3bAIAYp:v23DgmJMYxVoy0xYSiA3P0t
Threatray	1'139 similar samples on MalwareBazaar
TLSH	6884592F6D157E75C37286BF4CC2F04BE1915B0A21E653887B5EF3266E33C2629611AC
Reporter	Libranalysis
Tags:	AZORult

Libranalysis

Uploaded as part of the sample sharing project

Intelligence

File Origin

# of uploads :

# of downloads :

252

Origin country :

n/a

Vendor Threat Intelligence

Malware family:

n/a

ID:

File name:

SwiftNotice.exe

Verdict:

Suspicious activity

Analysis date:

2021-05-24 07:02:58 UTC

Tags:

n/a

Link:

https://app.any.run/tasks/ec90fae8-3d40-493b-9a2a-7336b587cce4

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

Detection:

Azorult

Link:

https://www.capesandbox.com/analysis/161309/

Result

Verdict:

Malware

Maliciousness:

Behaviour

Sending a UDP request

Creating a file in the %temp% directory

Creating a process from a recently created file

Creating a file

DNS request

Sending an HTTP POST request

Deleting a recently created file

Creating a window

Unauthorized injection to a recently created process

Unauthorized injection to a recently created process by context flags manipulation

Enabling autorun by creating a file

Result

Verdict:

UNKNOWN

Details

Windows PE Executable

Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.

Result

Threat name:

Azorult

Detection:

malicious

Classification:

phis.spyw.evad

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/790158

Signature

.NET source code contains potential unpacker

.NET source code contains very large strings

Allocates memory in foreign processes

Creates an undocumented autostart registry key

Found many strings related to Crypto-Wallets (likely being stolen)

Injects a PE file into a foreign processes

Machine Learning detection for sample

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)

Tries to harvest and steal Bitcoin Wallet information

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal ftp login credentials

Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)

Tries to steal Crypto Currency Wallets

Tries to steal Instant Messenger accounts or passwords

Tries to steal Mail credentials (via file access)

Writes to foreign memory regions

Yara detected Azorult

Yara detected Azorult Info Stealer

Behaviour

Behavior Graph:

Download SVG

Detection:

azorult

Link:

https://mwdb.cert.pl/sample/fee418041d28861c7b1335f745efc041547e947e672aed9ff43858bb7440f701/

Threat name:

ByteCode-MSIL.Downloader.Seraph

Status:

Malicious

First seen:

2021-05-24 08:04:10 UTC

AV detection:

15 of 47 (31.91%)

Threat level:

3/5

Detection(s):

Malicious file

Link:

https://check.spamhaus.org/check/?searchterm=73sbqba5fcdby6ytgx3ul36aifkh5fd6m4vo3h7uhbmlw5ca64aq._file

Verdict:

malicious

Label(s):

azorult

Result

Malware family:

azorult

Score:

10/10

Tags:

family:azorult discovery infostealer spyware stealer trojan

Link:

https://tria.ge/reports/210524-6zw32agnqx/

Behaviour

Checks processor information in registry

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

Suspicious use of SetThreadContext

Accesses cryptocurrency files/wallets, possible credential harvesting

Checks installed software on the system

Loads dropped DLL

Reads data files stored by FTP clients

Reads local data of messenger clients

Reads user/profile data of local email clients

Reads user/profile data of web browsers

Azorult

Malware Config

C2 Extraction:

http://ahsanulalam.buet.ac.bd/bvyukiu/index.php

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Azorult

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/fee418041d28861c7b1335f745efc041547e947e672aed9ff43858bb7440f701

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	pe_imphash Create hunting rule

Rule name:	Skystars_Malware_Imphash Create hunting rule
Author:	Skystars LightDefender
Description:	imphash

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape

https://www.capesandbox.com/analysis/161309/

Comments

Login required

You need to login to in order to write a comment. Login with your abuse.ch account.

No comments found for this malware sample