MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 02ca7727a3bf102045915fb243cdbd744c34f4e40b9b9824509dfcf53630455e. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AZORult


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 02ca7727a3bf102045915fb243cdbd744c34f4e40b9b9824509dfcf53630455e
SHA3-384 hash: e507932c44eda02006c524a41732e012cfaf768e3f5ecf1c29f17c1de783fd3a84fd6f783f9b8bebb4275b25eae8a6cb
SHA1 hash: 9807774ed6bbe79273ee573e76a651abce0993dc
MD5 hash: 1610e4005f0a95314cccafdc6d320bce
humanhash: purple-low-fillet-tango
File name:e-dekont.html.img
Download: download sample
Signature AZORult
Create hunting rule
File size:1'245'184 bytes
First seen:2020-10-21 08:46:29 UTC
Last seen:Never
File type: img
MIME type:application/x-iso9660-image
ssdeep 6144:sQxMDCTcT7jfoEyfybLeEaYDOQoEl9SqpmxkpfsXib2TcLk3l8hjQgg2bQgEV6vJ:wDCY7oJQIYDfmx+qi9kEMW
TLSH D045F4A7F2D5C2F3D4B92A3951394BF10325EC19BA22DB7E12487E6D2F72F81194B061
Reporter abuse_ch
Tags:AZORult geo img TUR ZiraatBank


Avatar
abuse_ch
Malspam distributing unidentified malware:

HELO: mail.ihszimbra8.com
Sending IP: 94.138.192.165
From: ZİRAAT BANKASI <ziraatbank@ileti.ziraatbank.com.tr>
Subject: DEKONT
Attachment: e-dekont.html.img (contains "e-dekont.html.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
137
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Heur.5021.25140.UNOFFICIAL
Create hunting rule

Detection:
n/a
Link:
https://mwdb.cert.pl/sample/02ca7727a3bf102045915fb243cdbd744c34f4e40b9b9824509dfcf53630455e/
Threat name:
Win32.Infostealer.Stimilina
Create hunting rule
Status:
Malicious
First seen:
2020-10-21 08:27:54 UTC
AV detection:
15 of 28 (53.57%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=alfhoj5dx4icarmrl6zehtn5orgdj5hebonzqjcqtx6pknrqivpa._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AZORult

img 02ca7727a3bf102045915fb243cdbd744c34f4e40b9b9824509dfcf53630455e

(this sample)

AZORult

Executable exe 7862be8b6b58fc073c3b91badfeab7f5d939725074f2022be9430f89c594692d

  
Dropping
MD5 c2b0e1a12df13cad8d7f86559ed0eb57
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 7862be8b6b58fc073c3b91badfeab7f5d939725074f2022be9430f89c594692d

Comments