MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 bb20b8d9dcfa42460e7942f1808f03e27ccc6f51cd86aa3b70239283afa48b55. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AZORult


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: bb20b8d9dcfa42460e7942f1808f03e27ccc6f51cd86aa3b70239283afa48b55
SHA3-384 hash: 948f80f337bc0f206fc8ae62892a1dde8aaeea5105ea8358daf67935230a400b75c1c53375acd3d1e18a68b2b509c2eb
SHA1 hash: 7f32f6bcf7123e919405a5664b508c8231e27fbf
MD5 hash: d238522550a284b0f998ec9f8ddc74f4
humanhash: table-colorado-glucose-nebraska
File name:Damage.rar
Download: download sample
Signature AZORult
Create hunting rule
File size:1'810'874 bytes
First seen:2020-12-08 16:08:15 UTC
Last seen:Never
File type: rar
MIME type:application/x-rar
ssdeep 49152:LlYNumNea1IfGBy8me0pcpJmwVGq18zpuxCgoIWI:hYbNzsGBy/ehp4woq5CJI
TLSH 0585334BD01F52C5C82F301B182DBB75BAE94C2FCDE76E849A65164532E6386FA231CD
Reporter cocaman
Tags:AZORult rar


Avatar
cocaman
Malicious email (T1566.001)
From: "Pu, Xin <xin.pu@siemens.com>" (likely spoofed)
Received: "from siemens.com (unknown [103.99.1.174]) "
Date: "8 Dec 2020 07:56:10 -0800"
Subject: "RE RE; Technical confirmation on GV fan"
Attachment: "Damage.rar"

Intelligence

File Origin
# of uploads :
1
# of downloads :
241
Origin country :
n/a
Vendor Threat Intelligence
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/bb20b8d9dcfa42460e7942f1808f03e27ccc6f51cd86aa3b70239283afa48b55/
Threat name:
Win32.Trojan.Bancteian
Create hunting rule
Status:
Malicious
First seen:
2020-12-08 16:09:08 UTC
File Type:
Binary (Archive)
Extracted files:
89
AV detection:
28 of 48 (58.33%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=xmqlrwo47jbemdtzilyybdyd4j6my32rzwdkuo3qeojihl5ernkq._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/bb20b8d9dcfa42460e7942f1808f03e27ccc6f51cd86aa3b70239283afa48b55

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AZORult

rar bb20b8d9dcfa42460e7942f1808f03e27ccc6f51cd86aa3b70239283afa48b55

(this sample)

AZORult

Executable exe ae628fd84f2ba783d82aa6e8804e7c41341671758e04ebc236f76ef7c7bee129

  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 ae628fd84f2ba783d82aa6e8804e7c41341671758e04ebc236f76ef7c7bee129
  
Dropping
Bancteian

Comments