MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 f54f88aa96e5a78ba79357ff00df973e725276884b152336e56e55cc009c315a. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AZORult


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: f54f88aa96e5a78ba79357ff00df973e725276884b152336e56e55cc009c315a
SHA3-384 hash: d5cf0c7b41f85d3815a93b6ed68b8c55ddb301f38faf83917c642fb89f449d63776bf17db5cd5ffbdfaf06f103237f10
SHA1 hash: 976e2ad2f774d5a9fa3db67009a0c3cd8bccb1a8
MD5 hash: 56b60bc6c463156f692bb1f35aa4ef31
humanhash: sink-vegan-muppet-uncle
File name:Scan Docs_pdf.r00
Download: download sample
Signature AZORult
Create hunting rule
File size:190'673 bytes
First seen:2020-10-20 08:56:02 UTC
Last seen:Never
File type: r00
MIME type:application/x-rar
ssdeep 3072:Dv1nP6OgyAzwdMIV1MTonnNcR1tWuTLDy5qDFy7fFicjQniusxLjvbXuje:DdP6OgNz+Mwet1tWwqAD47H0nsRYe
TLSH F4142317BA7126037529B100835FB935257AC896BEAF7B71BD60C98E9C670C391F4A0D
Reporter abuse_ch
Tags:AZORult Maersk r00


Avatar
abuse_ch
Malspam distributing AZORult:

HELO: dbd0.311.mevvia.ml
Sending IP: 167.99.139.76
From: Maersk Line <worldwide@maerskline.com>
Subject: DHL CONSIGNMENT NOTIFICATION
Attachment: Scan Docs_pdf.r00 (contains "Scan Docs_pdf.bat")

AZORult C2:
http://45.137.22.58/udu/index.php

Intelligence

File Origin
# of uploads :
1
# of downloads :
140
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/f54f88aa96e5a78ba79357ff00df973e725276884b152336e56e55cc009c315a/
Threat name:
Win32.Trojan.Wacatac
Create hunting rule
Status:
Malicious
First seen:
2020-10-20 08:05:39 UTC
AV detection:
10 of 46 (21.74%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=6vhyrkuw4wtyxj4tk77qbx4xhzzfe5uijmksgnxfnzk4yae4gfna._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/f54f88aa96e5a78ba79357ff00df973e725276884b152336e56e55cc009c315a

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AZORult

r00 f54f88aa96e5a78ba79357ff00df973e725276884b152336e56e55cc009c315a

(this sample)

AZORult

Executable exe 8e9ebe1cdcabac2e6820fa7a6a7702846adecdb18cd1e83700007e2dc745f5ce

  
Dropping
MD5 b441111cbeb43b967c31e5d4e3ebc59b
  
Dropping
AZORult
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 8e9ebe1cdcabac2e6820fa7a6a7702846adecdb18cd1e83700007e2dc745f5ce

Comments