MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 eb7b1c65da63735aa882902e84e459109336c6360d6efc70b7b7ebc42f3c82c9. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AZORult


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: eb7b1c65da63735aa882902e84e459109336c6360d6efc70b7b7ebc42f3c82c9
SHA3-384 hash: a39ca883945ac1df2a794763507e91bc5aeffb83053828d215b835aeb5e11c0cd0d12957d31440b5a48365c2387d50e4
SHA1 hash: 9194cd3adb3707aefda43d9faae1b31f1f9f39fa
MD5 hash: cf5611c7b8690f1e21cbb9f1c37a841b
humanhash: lima-rugby-robert-lemon
File name:New Purchase Order Ref 002324.zip
Download: download sample
Signature AZORult
Create hunting rule
File size:690'340 bytes
First seen:2021-03-03 07:40:15 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 12288:lOUw0GOg5G/9+p0gBVZHeDLJJF51dA2xd2EKaB0YLsKLjhrREz9ET4Jh/ZVRochL:lOUHgBVlIJF5Y2FX0YLsKxr+y47BVRoU
TLSH 19E4239A8DBEB9DFEC8B1EA31DD1C2D9318A3876B73933411ABDA18067D3C115D4A047
Reporter abuse_ch
Tags:zip


Avatar
abuse_ch
Malspam distributing unidentified malware:

HELO: oswalcastings.co.in
Sending IP: 180.214.239.43
From: Anita_Purchasing Dep <customercare@oswalcastings.co.in>
Subject: Re:Purchase Order And Pi Required
Attachment: New Purchase Order Ref 002324.zip (contains "New Purchase Order Ref 002324.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
124
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Heur.7814.30952.UNOFFICIAL
Create hunting rule

Result
Verdict:
UNKNOWN
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/eb7b1c65da63735aa882902e84e459109336c6360d6efc70b7b7ebc42f3c82c9/
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2021-03-03 07:40:34 UTC
AV detection:
14 of 48 (29.17%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=5n5ryzo2mnzvvkecsaxijzczccjtnrrwbvxpy4fxw7v4ilz4qleq._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Suspicious File
Score:
0.35
Link:
https://yomi.yoroi.company/submissions/eb7b1c65da63735aa882902e84e459109336c6360d6efc70b7b7ebc42f3c82c9

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AZORult

zip eb7b1c65da63735aa882902e84e459109336c6360d6efc70b7b7ebc42f3c82c9

(this sample)

AZORult

Executable exe 4ad543d4fb39532920988755ce86ece5ba98421463d9bf6137410283893d47c1

  
Dropping
MD5 31f6a4ac74763ef29bff7e07a7cc0d81
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 4ad543d4fb39532920988755ce86ece5ba98421463d9bf6137410283893d47c1

Comments