MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 dc51e5a3ae3d8e2da1132c48b59656e3ca32e19373c2a397e483017c1e2ea7a0. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AZORult


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: dc51e5a3ae3d8e2da1132c48b59656e3ca32e19373c2a397e483017c1e2ea7a0
SHA3-384 hash: d754639a6c1ea7710f3fd5f0d90a7af7ab3520a5728738d700ef878cc9e62261a2568e3617c1260f5f3c12dc5161c81e
SHA1 hash: 2e5b8014cdf049c5734941a6eadcfb7824f8332d
MD5 hash: 4708c034ca820cd088912010562e1d87
humanhash: xray-equal-avocado-crazy
File name:Bid Material List Questionaire.zip
Download: download sample
Signature AZORult
Create hunting rule
File size:771'145 bytes
First seen:2020-08-18 11:20:35 UTC
Last seen:2020-08-18 11:48:19 UTC
File type: zip
MIME type:application/zip
ssdeep 12288:/QP1aOSdezizSPI26uxuKUPiFGgXVvNC3o9bH67cHC44s7bsiy03GfJJiFGNkih6:/QsHZaI2PAVgFvNIo9bH6IC4LbqYGfJA
TLSH 66F423B446FE11CDA44C286646E850608F62D2326D06CBEF5A97F6FD22743EB1807BD2
Reporter abuse_ch
Tags:AZORult zip


Avatar
abuse_ch
Malspam distributing AZORult:

HELO: server.sgbcg.com
Sending IP: 113.11.251.241
From: Gerhard Müller <theodor@vdbweb.de>
Reply-To: me<tomisalvmijic@gmail.com>
Subject: Tender Bid Quotation request
Attachment: Bid Material List Questionaire.zip (contains "Bid Material List.exe")

AZORult C2:
http://136.144.237.217/index.php

Intelligence

File Origin
# of uploads :
2
# of downloads :
224
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
PUA.Win.Adware.Slugin-6803969-0
Create hunting rule

PUA.Win.Adware.Slugin-6840354-0
Create hunting rule

Detection:
n/a
Link:
https://mwdb.cert.pl/sample/dc51e5a3ae3d8e2da1132c48b59656e3ca32e19373c2a397e483017c1e2ea7a0/
Threat name:
Win32.Trojan.LokiBot
Create hunting rule
Status:
Malicious
First seen:
2020-08-18 11:22:05 UTC
AV detection:
20 of 48 (41.67%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=3ri6li5ohwhc3iitfrellfsw4pfdfymtopbkhf7eqmaxyhrou6qa._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AZORult

zip dc51e5a3ae3d8e2da1132c48b59656e3ca32e19373c2a397e483017c1e2ea7a0

(this sample)

AZORult

Executable exe 6a0a4894127b64d80992079cbcce8ab2b6998e65ac8dca03259697db83dc9332

  
Dropping
MD5 a59bb44675a57e44bfb5e98caf80e556
  
Dropping
AZORult
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 6a0a4894127b64d80992079cbcce8ab2b6998e65ac8dca03259697db83dc9332
  
Dropping
SHA256 b9929d5795c560d38f4e9a62b9f67c125f05af52411b0f780ccdaf30c5940a76
  
Dropping
MD5 6c7a2d0ccc7a56baf008f879b1ef7450

Comments