MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 a68db55036ba052e3ff2bc08f6d01580a883fc71345c7957e91b41d5f1c4663d. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AZORult


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: a68db55036ba052e3ff2bc08f6d01580a883fc71345c7957e91b41d5f1c4663d
SHA3-384 hash: 71f14c892bb12d3b292bf6e2fae922d62f2852a641f25d46ae925a08b6cc19ac4a00f9095e6924b40fa0aee2a33fcd60
SHA1 hash: 9e5fdbd63f0dfed7b86dc8193a75e690b57163bf
MD5 hash: 3d14e212241946b7ed14dbf1cd2b8111
humanhash: jersey-skylark-timing-arizona
File name:PROFORMA INV SCAN COPY 8220_pdf.zip
Download: download sample
Signature AZORult
Create hunting rule
File size:141'507 bytes
First seen:2020-10-22 07:10:32 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 3072:56CiXXzVTvjhx8J7ykX+OxW2YY3sMAVvwaibo7lu7obwRmn5yf:56lBR6WkX+OxSrRjWoJu7Bo5a
TLSH 6FD3121385D8956EC3AE723364BC7CE98F86060D4D35113B6C323222E5DB77D66ACA6C
Reporter abuse_ch
Tags:AZORult zip


Avatar
abuse_ch
Malspam distributing AZORult:

HELO: smtp7.whygroup.it
Sending IP: 130.117.239.117
From: Nghien Cuu Phat Trien <sales@silopcorp.vn>
Reply-To: nklaun59@gmail.com
Subject: DOCUMENTS & INV SCAN COPY #8220
Attachment: PROFORMA INV SCAN COPY 8220_pdf.zip (contains "PROFORMA INV SCAN COPY #8220_pdf.exe")

AZORult C2:
http://kmtrealestate.com.na/PL341/index.php

AgentTesla payload URL:
http://plasticsheets.ie/Chrome.exe

Intelligence

File Origin
# of uploads :
1
# of downloads :
128
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Sanesecurity.Malware.25815.ZipHeur.BadExt.UNOFFICIAL
Create hunting rule

Detection:
n/a
Link:
https://mwdb.cert.pl/sample/a68db55036ba052e3ff2bc08f6d01580a883fc71345c7957e91b41d5f1c4663d/
Threat name:
ByteCode-MSIL.Trojan.Wacatac
Create hunting rule
Status:
Malicious
First seen:
2020-10-22 04:53:55 UTC
AV detection:
11 of 48 (22.92%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=u2g3kubwxics4p7sxqepnuavqcuih7drgrohsv7jdna5l4oemy6q._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AZORult

zip a68db55036ba052e3ff2bc08f6d01580a883fc71345c7957e91b41d5f1c4663d

(this sample)

AZORult

Executable exe 6853956661336de789939b113160c9316bc33c213c6633cc98636f107616e538

  
URLhaus
https://urlhaus.abuse.ch/url/733347/
  
Dropping
MD5 e8ef12fb6ac6a992887189b4779deb12
  
Dropping
AZORult
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 6853956661336de789939b113160c9316bc33c213c6633cc98636f107616e538

Comments