MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 b4c7de6f0ee68b66df3ae2360d8527d418e54e1261f8c3180f96f7153732d6ca. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AZORult


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: b4c7de6f0ee68b66df3ae2360d8527d418e54e1261f8c3180f96f7153732d6ca
SHA3-384 hash: dca0d4ac7fafa35359961de127ec2327b969f76a182e80a54b3e5edeff4da954046f88ae5314b40db280de6dbd9309eb
SHA1 hash: ed2b813a94ef1447f390cc74da5d12f36dd8ed02
MD5 hash: c8d0abc24cae6482e75a84f738bd0ffb
humanhash: sink-florida-twenty-illinois
File name:Product Enquiry.zip
Download: download sample
Signature AZORult
Create hunting rule
File size:416'606 bytes
First seen:2020-08-17 19:10:40 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 12288:zD+e0qppaWFvhHTSpWXuz2UWPB9hc/1TAFnDsee7t+CV:zqehppbbua7TqqxDseodV
TLSH 6C94230EC12D90DD2D63289B3FA8AF1D2E688C54805F589594F718609ACDB397B9B33D
Reporter abuse_ch
Tags:AZORult zip


Avatar
abuse_ch
Malspam distributing AZORult:

HELO: server.sgbcg.com
Sending IP: 113.11.251.241
From: farzna@webmasterstech.com
Subject: Retail Inquiry (Wholesale & Retail)
Attachment: Product Enquiry.zip (contains "Product Enquiry.exe")

AZORult C2:
http://3.126.249.36/index.php

Intelligence

File Origin
# of uploads :
1
# of downloads :
230
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
PUA.Win.Adware.Slugin-6803969-0
Create hunting rule

PUA.Win.Adware.Slugin-6840354-0
Create hunting rule

SecuriteInfo.com.BScope.Trojan.Crypt.5088.UNOFFICIAL
Create hunting rule

Detection:
n/a
Link:
https://mwdb.cert.pl/sample/b4c7de6f0ee68b66df3ae2360d8527d418e54e1261f8c3180f96f7153732d6ca/
Threat name:
Win32.Infostealer.Fareit
Create hunting rule
Status:
Malicious
First seen:
2020-08-17 19:12:06 UTC
AV detection:
24 of 29 (82.76%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=wtd543yo42fwnxz24i3a3bjh2qmoktqsmh4mggaps33rknzs23fa._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Lokibot
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/b4c7de6f0ee68b66df3ae2360d8527d418e54e1261f8c3180f96f7153732d6ca

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AZORult

zip b4c7de6f0ee68b66df3ae2360d8527d418e54e1261f8c3180f96f7153732d6ca

(this sample)

AZORult

Executable exe 7fb195bc96bd220998dd778dd9e6fcb70320102bbb8656d4c765800ad8d9bb83

  
Dropping
MD5 a088a8534e0012898cd97bb5ea57fe14
  
Dropping
AZORult
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 7fb195bc96bd220998dd778dd9e6fcb70320102bbb8656d4c765800ad8d9bb83

Comments