MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 c6a6f672b8239f4b4780deb8e1a8048cc2babf9c1fcc81f9bd7bc3d4cc9492a6. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AZORult


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: c6a6f672b8239f4b4780deb8e1a8048cc2babf9c1fcc81f9bd7bc3d4cc9492a6
SHA3-384 hash: 5a0bc21be5aec561a3c860ad54b5c6089b72e4ae4eea81c2e961e1534b6ec749d8052497d245ef7f56b447ac8bf1f782
SHA1 hash: 12aca79e2d94cbcfa1db29bee0464f462aa462c7
MD5 hash: 854b13ea385e2c86aede47bdfb5b13d0
humanhash: papa-hydrogen-virginia-rugby
File name:Bidvest Order RFQ BV322910098ZA.PDF.gz.gz
Download: download sample
Signature AZORult
Create hunting rule
File size:462'505 bytes
First seen:2020-10-27 10:18:00 UTC
Last seen:Never
File type: gz
MIME type:application/gzip
ssdeep 12288:QEP5TQA1YdSh2p1vHKinuDNQCBSFZaKUl5U9:QEhTJZh2+in0NQqSFZa9U9
TLSH A2A423A08A5C09125C52503C486FC2FDD83F31C2EDA16D2D756FD191BDABDE458B35AC
Reporter abuse_ch
Tags:AZORult gz


Avatar
abuse_ch
Malspam distributing AZORult:

HELO: host.noanfair.com
Sending IP: 69.64.34.145
From: invoices@bidvestgroup.co.za
Subject: Bidvest Order: RFQ BV322910098ZA
Attachment: Bidvest Order RFQ BV322910098ZA.PDF.gz.gz (contains "Bidvest Order RFQ BV322910098ZA.PDF.gz.exe")

AZORult C2:
http://45.145.185.111/owa/index.php

Intelligence

File Origin
# of uploads :
1
# of downloads :
138
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Mal.DrodGzip-A.23090.13769.UNOFFICIAL
Create hunting rule

Detection:
n/a
Link:
https://mwdb.cert.pl/sample/c6a6f672b8239f4b4780deb8e1a8048cc2babf9c1fcc81f9bd7bc3d4cc9492a6/
Threat name:
Win32.Trojan.Wacatac
Create hunting rule
Status:
Malicious
First seen:
2020-10-27 06:04:41 UTC
AV detection:
7 of 48 (14.58%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=y2tpm4vyeopuwr4a324odkaertblvp44d7gid6n5ppb5jteuskta._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AZORult

gz c6a6f672b8239f4b4780deb8e1a8048cc2babf9c1fcc81f9bd7bc3d4cc9492a6

(this sample)

AZORult

Executable exe bca4b6e9f14cb4d84674d2f4db286e0ea692f68e8b1d906d04ced807556c6174

  
Dropping
MD5 e2a14164c28e5bc72c86d4d13a48dcd1
  
Dropping
AZORult
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 bca4b6e9f14cb4d84674d2f4db286e0ea692f68e8b1d906d04ced807556c6174

Comments