MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 a1fb52524a68fbfeb5e8cdfaa411663d9fc9fa7664f69f2a2fea7ef91702ab46. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AZORult


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: a1fb52524a68fbfeb5e8cdfaa411663d9fc9fa7664f69f2a2fea7ef91702ab46
SHA3-384 hash: ae5a5ef9ab6ac62efc68de0c7f5caff1d19351e8e490d3d4939ac6835af80e4fc42c8067162e09533be2efdb2050967d
SHA1 hash: 76821f4c48ca512ddf436e574f095c784127e901
MD5 hash: 4cf0787a6998f30d192d000203558372
humanhash: louisiana-mars-yellow-robert
File name:Proforma invoice.zip
Download: download sample
Signature AZORult
Create hunting rule
File size:280'694 bytes
First seen:2021-02-21 18:12:13 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 6144:atAYBE2SBM1DNujtQhxclfCwZz5uzzRvTDslVzkaX:PY62S+1DNiWE1uz1LDslVzFX
TLSH 2B5423D0B0B37A8B79614C00677849E73E1255E803F19FC7EAAB099573ACE0506DFD6A
Reporter abuse_ch
Tags:AZORult zip


Avatar
abuse_ch
Malspam distributing AZORult:

HELO: mail.globexdesign.com
Sending IP: 142.4.2.6
From: Ratna Fardilla <conact@shadmantents.com>
Reply-To: Ratna Fardilla <biz@eloquentcs.com>
Subject: Proforma invoice
Attachment: Proforma invoice.zip (contains "Proforma invoice.exe")

AZORult C2:
http://198.71.50.125/index.php

Intelligence

File Origin
# of uploads :
1
# of downloads :
298
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Sanesecurity.Foxhole.Zip_fn23.UNOFFICIAL
Create hunting rule

Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/a1fb52524a68fbfeb5e8cdfaa411663d9fc9fa7664f69f2a2fea7ef91702ab46/
Threat name:
Win32.Trojan.Wacatac
Create hunting rule
Status:
Malicious
First seen:
2021-02-21 18:13:05 UTC
AV detection:
12 of 47 (25.53%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=uh5veusknd575npizx5kielghwp4t6twmt3j6krp5j7psfycvnda._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AZORult

zip a1fb52524a68fbfeb5e8cdfaa411663d9fc9fa7664f69f2a2fea7ef91702ab46

(this sample)

AZORult

Executable exe 24ed16aa91766bd198e5d026082e7c19a16739a1defa14b0b9a3363be6155996

  
Dropping
MD5 a79115f8510618e9098061aa5ca762fc
  
Dropping
AZORult
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 24ed16aa91766bd198e5d026082e7c19a16739a1defa14b0b9a3363be6155996

Comments