MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 09d41e6477b1ac450ea734f17a2ef4b521887e2eddca89e03b52e7f16465260b. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AZORult


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 09d41e6477b1ac450ea734f17a2ef4b521887e2eddca89e03b52e7f16465260b
SHA3-384 hash: 4145d551b2c91d74eeba3c68d4fc2ac409e42538d2de868f4dfcd3865a16d7cbc957f04fda7312d7cd3995e0cfc4cecd
SHA1 hash: 61e039c5451ee9d4ec46a2805b21f283a050be6f
MD5 hash: b139438b93bdf1d4f8abe4942948a01d
humanhash: mexico-lima-may-georgia
File name:Ziraat Bankasi Swift Mesaji.r00
Download: download sample
Signature AZORult
Create hunting rule
File size:259'717 bytes
First seen:2021-01-12 18:02:37 UTC
Last seen:Never
File type: r00
MIME type:application/x-rar
ssdeep 6144:DzZe5PHQmUcbcpzoGINkFNNdZcBJNeKuWwlwaai:nZe5YsiclkFxZcBYWwq4
TLSH D544238C930AE3B6169E52195CAF6DD2F68673490F0FB18EABD38EC446C55442F846F2
Reporter abuse_ch
Tags:AZORult geo r00 TUR ZiraatBank


Avatar
abuse_ch
Malspam distributing unidentified malware:

HELO: ileti.ziraatbank.com.tr
Sending IP: 160.20.147.163
From: ZIRAAT BANKASI <ziraatbank@ileti.ziraatbank.com.tr>
Reply-To: ZIRAAT BANKASI <ziraatbank@ileti.ziraatbank.com.tr>
Subject: FW:12000, EUR Swift Bildirimi
Attachment: Ziraat Bankasi Swift Mesaji.r00 (contains "Ziraat Bankasi Swift Mesaji.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
237
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Heur.10917.21419.UNOFFICIAL
Create hunting rule

Detection:
n/a
Link:
https://mwdb.cert.pl/sample/09d41e6477b1ac450ea734f17a2ef4b521887e2eddca89e03b52e7f16465260b/
Threat name:
ByteCode-MSIL.Trojan.Pwsx
Create hunting rule
Status:
Malicious
First seen:
2021-01-12 18:03:05 UTC
AV detection:
12 of 46 (26.09%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=bhkb4zdxwgwekdvhgtyxulxuwuqyq7ro3xfityb3klt7czdfeyfq._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/09d41e6477b1ac450ea734f17a2ef4b521887e2eddca89e03b52e7f16465260b

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AZORult

r00 09d41e6477b1ac450ea734f17a2ef4b521887e2eddca89e03b52e7f16465260b

(this sample)

AZORult

Executable exe 3d39fc826f6ed0115155842080406ffc82f930c5daae8ef710d3c30009fd0106

  
Dropping
MD5 35c69b2c315a5b7d4fe4a2106dad3921
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 3d39fc826f6ed0115155842080406ffc82f930c5daae8ef710d3c30009fd0106

Comments