MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 33cc4158f5621e4dbfb96ce575d0e7a5d8c110980e8047b14b76b37598a2a887. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

AZORult

Vendor detections: 3

Intelligence 3 IOCs YARA 1 File information Comments

SHA256 hash:	33cc4158f5621e4dbfb96ce575d0e7a5d8c110980e8047b14b76b37598a2a887
SHA3-384 hash:	d534e0a4da23426a60591278c3447c5922f28849bf769e90829b6bc8d1baaf64af0d3d182c9ab7df66b4d830bd0fb58e
SHA1 hash:	f54ed15fb5d448686414d143f0d4eb751700f7ef
MD5 hash:	b35985d071f0009cff082c520a332c88
humanhash:	carpet-item-utah-video
File name:	Bankcopy_06c57144_2020-20-04-15bb6_DE_E-INVOICE_20-613129926-13.hta
Download:	download sample
Signature	AZORult Create hunting rule
File size:	14'651 bytes
First seen:	2020-05-06 18:26:49 UTC
Last seen:	Never
File type:	hta
MIME type:	text/html
ssdeep	48:3838mtl8j9LBH0Tyno4R0yluuuuuuuuuuuuuuuumnlIIoBuuuuuuuuuuuuuuuuu5:0hAll0q4/
TLSH	DF62133CAF64E990C2FBD1FD1409754398A5CB3BA114EE29BC8C0463E32916F5D641AF
Reporter	abuse_ch
Tags:	AZORult hta

abuse_ch

Malspam distributing AZORult:

HELO: dkv-euroservice.pw
Sending IP: 101.99.90.94
From: DKV EURO SERVICE GmbH + Co. KG <sales@dkv-euroservice.pw>
Subject: AW: AW: Invoice Payment for WK 15/21 to WK 19/21
Attachment: Bankcopy_06c57144_2020-20-04-15bb6_DE_E-INVOICE_20-613129926-13.zip (contains "Bankcopy_06c57144_2020-20-04-15bb6_DE_E-INVOICE_20-613129926-13.hta")

AZORult payload URL:
http://zedfire.duckdns.org/invoice.exe

AZORult C2:
http://lemado.duckdns.org/index.php (38.117.96.180)

Intelligence

File Origin

# of uploads :

# of downloads :

126

Origin country :

n/a

Vendor Threat Intelligence

Detection(s):

SecuriteInfo.com.VBS.ObfDldr.18.Gen.17048.4470.UNOFFICIAL

Gathering data

Threat name:

Script-VBS.Downloader.Obfdldr

Status:

Malicious

First seen:

2020-05-06 18:36:23 UTC

File Type:

Text (HTML)

Extracted files:

AV detection:

10 of 48 (20.83%)

Threat level:

2/5

Detection(s):

Malicious file

Link:

https://check.spamhaus.org/check/?searchterm=gpgecwhvmipe3p5zntsxluhhuxmmceeyb2aepmklo2zxlgfcvcdq._file

Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	PowerShell_Case_Anomaly Create hunting rule
Author:	Florian Roth
Description:	Detects obfuscated PowerShell hacktools
Reference:	https://twitter.com/danielhbohannon/status/905096106924761088