MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 1f2ef2960500047c8fa72bd883144387ded94900637e1a281a10449a1f1a3bd4. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AZORult


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 1f2ef2960500047c8fa72bd883144387ded94900637e1a281a10449a1f1a3bd4
SHA3-384 hash: 41845ed72ddb4fb4805d824a190e0e5f743b335082905d64d7911d55110d684733696155c99da5e1a34efc41b8bac235
SHA1 hash: 83c6153934e8b1dc7d57b1cc948ad08dd29b2916
MD5 hash: c96fed9bbf4caccfebe52955da37e123
humanhash: cola-mexico-idaho-emma
File name:Company Profile.zip
Download: download sample
Signature AZORult
Create hunting rule
File size:415'630 bytes
First seen:2021-01-18 07:54:37 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 6144:7Zzp684HrsKnXu/euKdOe0joC0SXCmEzk4AAb6aNyLCy/Dh:TOr3SebOA1iwyLCIh
TLSH F69423B2240BA5BE4578E03361F0B50DB33BE422C91FB5385025E7B2DDD6593964B2EB
Reporter abuse_ch
Tags:AZORult zip


Avatar
abuse_ch
Malspam distributing AZORult:

HELO: mail.richermoren.gq
Sending IP: 118.27.16.167
From: Alex B <alex@rzbmco.com>
Subject: Enquiry
Attachment: Company Profile.zip (contains "Company Profile.exe")

AZORult C2:
http://139.162.75.17/index.php

Intelligence

File Origin
# of uploads :
1
# of downloads :
250
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Sanesecurity.Foxhole.Zip_fs163.UNOFFICIAL
Create hunting rule

SecuriteInfo.com.Trojan.Siggen11.57608.UNOFFICIAL
Create hunting rule

Sanesecurity.Malware.21076.ZipHeur.UNOFFICIAL
Create hunting rule

Detection:
n/a
Link:
https://mwdb.cert.pl/sample/1f2ef2960500047c8fa72bd883144387ded94900637e1a281a10449a1f1a3bd4/
Threat name:
Win32.Trojan.Wacatac
Create hunting rule
Status:
Malicious
First seen:
2021-01-18 07:55:12 UTC
AV detection:
8 of 46 (17.39%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=d4xpffqfaachzd5hfpmigfcdq7pnssiamn7buka2cbcjuhy2hpka._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/1f2ef2960500047c8fa72bd883144387ded94900637e1a281a10449a1f1a3bd4

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AZORult

zip 1f2ef2960500047c8fa72bd883144387ded94900637e1a281a10449a1f1a3bd4

(this sample)

AZORult

Executable exe 64d7e0b438049a21a6f6525f3c25d93edb0b5ed42df9d2a3e0135ec3f9a48878

  
Dropping
MD5 0a025a8bac7f6b7a92a9d5ad94dfda9d
  
Dropping
AZORult
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 64d7e0b438049a21a6f6525f3c25d93edb0b5ed42df9d2a3e0135ec3f9a48878

Comments