MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 ff2a69d6c6bf6bce9060d0570e2aec5f88a964c46736e3860152895cf94449f2. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AZORult


Vendor detections: 5


Intelligence 5 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: ff2a69d6c6bf6bce9060d0570e2aec5f88a964c46736e3860152895cf94449f2
SHA3-384 hash: 033f598a6551cee4bc7e721cc7ec55db164bdfa423c54e9dbba5ecc200b6c8dce7794209ef0667ca07e6b896d0fc25d8
SHA1 hash: 746ca5a9ed2635bcca39b3fd6098d6cc2ed2d197
MD5 hash: c37ea1e38b61b559cfa79afd09e142aa
humanhash: queen-timing-quebec-magnesium
File name:quotation request.exe
Download: download sample
Signature AZORult
Create hunting rule
File size:410'624 bytes
First seen:2020-06-10 04:08:52 UTC
Last seen:2020-06-10 14:33:26 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'652 x AgentTesla, 19'462 x Formbook, 12'204 x SnakeKeylogger)
ssdeep 12288:Mr6fi3zv68+6z+biZabk8onB2nPP/xMgynYDBW:Mr1jv68+U+biZek5B2PP4g
Threatray 7'996 similar samples on MalwareBazaar
TLSH 89946B483291F29EC417CC76CD98ACF06A506C67DB17D343A4633EADB97D6DA8E101E2
Reporter jarumlus
Tags:AZORult

Intelligence

File Origin
# of uploads :
4
# of downloads :
65
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Generic.mg.c37ea1e38b61b559.2447.UNOFFICIAL
Create hunting rule

Gathering data
Threat name:
ByteCode-MSIL.Backdoor.NanoCore
Create hunting rule
Status:
Malicious
First seen:
2020-06-10 04:10:05 UTC
File Type:
PE (.Net Exe)
Extracted files:
8
AV detection:
26 of 30 (86.67%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=74vgtvwgx5v45eda2blq4kxml6ekszgem43ohbqbkkevz6kejhza._file
Verdict:
malicious
Label(s):
azorult
Create hunting rule
Similar samples:
3e110af11b73e3e1b461904213d967ad02a502358a45ca068f1106b846e269b4
AZORult
4551d06a33be96c8808d2e180d6cf35c50cbf2dc114a51e90aa49bb4597e2936
AZORult
4639769fea49849bb1a85d41d7dc9f4975e0945b3e5b0622503a71b8a97faccf
AZORult
556078f7b9c9cc0472e000c38af7b5285ebc9e9e70282c5fa9e8b9063bcd16ac
AZORult
64f4cb67826d72ac5256bb0dd92604157d9e4a5e7603e6e68f3b262f8db041c1
AZORult
7580b583ccf57526e5a5ca40651ec5a95abe64b77a7c223f037443e480fbe185
AZORult
9d3df770b6dcd5beb650a097a597bb70c49dde306517bbc731812bf18a806719
AZORult
eb96ab93249a86be52aa53a58fb8667b4c54f6b6dbc899fd23ea56b12b52a001
AZORult
f158be721fb34c71dedeb65d051c18da565e0aa8e1e2bf1f86e585e93c22a739
AZORult
f7505d1a7254a1a38c4570f0abb3fe3a462d3c34efca6372841ac37876d2af05
AZORult
+ 7'986 additional samples on MalwareBazaar
Result
Malware family:
azorult
Create hunting rule
Score:
  10/10
Tags:
family:azorult discovery infostealer rezer0 spyware trojan
Link:
https://tria.ge/reports/201109-vv5antzb1s/
Behaviour
Checks processor information in registry
Creates scheduled task(s)
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Suspicious use of SetThreadContext
Accesses cryptocurrency files/wallets, possible credential harvesting
Checks installed software on the system
JavaScript code in executable
Loads dropped DLL
Reads data files stored by FTP clients
Reads user/profile data of local email clients
Reads user/profile data of web browsers
ServiceHost packer
rezer0
Azorult
Malware Config
C2 Extraction:
http://iscm.edu.ar/gold/32/index.php
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AZORult

z 2014c919774db3d52dc854fcbc46755ff0932264fe0b0f39a23ad3911eccb8d9

AZORult

Executable exe ff2a69d6c6bf6bce9060d0570e2aec5f88a964c46736e3860152895cf94449f2

(this sample)

  
Dropped by
MD5 850a013c96e3a26b0a7fad8089b04534
  
Dropped by
SHA256 2014c919774db3d52dc854fcbc46755ff0932264fe0b0f39a23ad3911eccb8d9
  
Delivery method
Distributed via e-mail attachment

Comments