AZORult_8d771e2dfc37a691d1620d670af18d33_exe_2019-08-01_09_30.txt

* MalFamily: ""

* MalScore: 10.0

* File Name: "AZORult_8d771e2dfc37a691d1620d670af18d33.exe"
* File Size: 914944
* File Type: "PE32 executable (GUI) Intel 80386, for MS Windows"
* SHA256: "72938db390deef0a57fe8a7a045eb26cf90e2b997ffec5dbbe9afb92703f3dcc"
* MD5: "8d771e2dfc37a691d1620d670af18d33"
* SHA1: "8ede3a7b6407082fbdfdf9a8bf41f2c10addcf46"
* SHA512: "14b657d6f3f2c6915e9723be228cff22dfb50bf850e03a435a8e2040e721ef65234a56fd40739fc339c3210d8a55313aa2c51123a4fbe4a9d453d8b2dd87907b"
* CRC32: "D8789640"
* SSDEEP: "12288:TqMitwH6AjLdDQSPY2E3k3txmKJwPKJseWKG8jAoe4utFvwMoDZtRR06he:eErLdDcnkd5JmKp5+oDoFzgZ906s"

* Process Execution:
    "AZORult_8d771e2dfc37a691d1620d670af18d33.exe",
    "AZORult_8d771e2dfc37a691d1620d670af18d33.exe"


* Executed Commands:
    "\"C:\\Users\\user\\AppData\\Local\\Temp\\AZORult_8d771e2dfc37a691d1620d670af18d33.exe\""


* Signatures Detected:

        "Description": "Creates RWX memory",
        "Details":


        "Description": "Possible date expiration check, exits too soon after checking local time",
        "Details":

                "process": "AZORult_8d771e2dfc37a691d1620d670af18d33.exe, PID 2536"




        "Description": "HTTP traffic contains suspicious features which may be indicative of malware related traffic",
        "Details":

                "post_no_referer": "HTTP traffic contains a POST request with no referer header"


                "ip_hostname": "HTTP connection was made to an IP address rather than domain name"


                "suspicious_request": "http://188.209.52.182/index.php"




        "Description": "Performs some HTTP requests",
        "Details":

                "url": "http://188.209.52.182/index.php"




        "Description": "The binary likely contains encrypted or compressed data.",
        "Details":

                "section": "name: .rsrc, entropy: 6.99, characteristics: IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_SHARED|IMAGE_SCN_MEM_READ, raw_size: 0x0002ce00, virtual_size: 0x0002cd6c"




        "Description": "Executed a process and injected code into it, probably while unpacking",
        "Details":

                "Injection": "AZORult_8d771e2dfc37a691d1620d670af18d33.exe(1812) -> AZORult_8d771e2dfc37a691d1620d670af18d33.exe(2536)"




        "Description": "File has been identified by 22 Antiviruses on VirusTotal as malicious",
        "Details":

                "FireEye": "Generic.mg.8d771e2dfc37a691"


                "Cylance": "Unsafe"


                "K7GW": "Trojan ( 005543041 )"


                "K7AntiVirus": "Trojan ( 005543041 )"


                "TrendMicro": "TrojanSpy.Win32.LOKI.SMDD.hp"


                "Symantec": "Packed.Generic.516"


                "Paloalto": "generic.ml"


                "Kaspersky": "HEUR:Backdoor.Win32.Androm.gen"


                "Endgame": "malicious (high confidence)"


                "Invincea": "heuristic"


                "McAfee-GW-Edition": "BehavesLike.Win32.Fareit.ch"


                "Microsoft": "Trojan:Win32/Wacatac.B!ml"


                "ZoneAlarm": "HEUR:Backdoor.Win32.Androm.gen"


                "AhnLab-V3": "Win-Trojan/Delphiless.Exp"


                "Acronis": "suspicious"


                "ESET-NOD32": "a variant of Win32/Injector.EGXY"


                "TrendMicro-HouseCall": "TrojanSpy.Win32.LOKI.SMDD.hp"


                "Rising": "Trojan.Injector!1.AFE3 (CLASSIC)"


                "Fortinet": "W32/Generic.AC.45B3D4!tr"


                "Cybereason": "malicious.b64070"


                "Panda": "Trj/GdSda.A"


                "CrowdStrike": "win/malicious_confidence_90% (W)"




        "Description": "Collects information to fingerprint the system",
        "Details":


        "Description": "Anomalous binary characteristics",
        "Details":

                "anomaly": "Timestamp on binary predates the release date of the OS version it requires by at least a year"





* Started Service:

* Mutexes:
    "A81FB8C60-BBE6E186-FC9B5DB5-36DA4559-33946726"


* Modified Files:

* Deleted Files:

* Modified Registry Keys:

* Deleted Registry Keys:

* DNS Communications:

* Domains:

* Network Communication - ICMP:

* Network Communication - HTTP:

        "count": 1,
        "body": "\\x00\\x00\\x00&f\\x96&f\\x9fE\\x17\\x8b0m\\xed&f\\x98&f\\x9e&g\\xeaA\\x17\\xeb&f\\x98Fp\\x9d2p\\x9d;p\\x9d5p\\x9cG\\x13\\xed&f\\x97Ap\\x9d6\\x11\\xec&f\\x9b&g\\xea&f\\x9d&f\\x98G\\x14\\x8b0a\\x8b0`\\x8b0`\\x8b0l\\x8b1\\x11\\x8b0f\\x8b0f\\x8b0l\\x8b0a\\x8b0c\\x8b0b\\x8b0g\\x8b0c",
        "uri": "http://188.209.52.182/index.php",
        "user-agent": "Mozilla/4.0 (compatible; MSIE 6.0b; Windows NT 5.1)",
        "method": "POST",
        "host": "188.209.52.182",
        "version": "1.1",
        "path": "/index.php",
        "data": "POST /index.php HTTP/1.1\r\nUser-Agent: Mozilla/4.0 (compatible; MSIE 6.0b; Windows NT 5.1)\r\nHost: 188.209.52.182\r\nContent-Length: 107\r\nCache-Control: no-cache\r\n\r\n\\x00\\x00\\x00&f\\x96&f\\x9fE\\x17\\x8b0m\\xed&f\\x98&f\\x9e&g\\xeaA\\x17\\xeb&f\\x98Fp\\x9d2p\\x9d;p\\x9d5p\\x9cG\\x13\\xed&f\\x97Ap\\x9d6\\x11\\xec&f\\x9b&g\\xea&f\\x9d&f\\x98G\\x14\\x8b0a\\x8b0`\\x8b0`\\x8b0l\\x8b1\\x11\\x8b0f\\x8b0f\\x8b0l\\x8b0a\\x8b0c\\x8b0b\\x8b0g\\x8b0c",
        "port": 80



* Network Communication - SMTP:

* Network Communication - Hosts:

* Network Communication - IRC: