MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 fead81a27ebd2a53f2b7b986afd89279125859406c892c71b2527c793d80b615. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AZORult


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: fead81a27ebd2a53f2b7b986afd89279125859406c892c71b2527c793d80b615
SHA3-384 hash: 95bfb363ab1d5416359e2980940808ad93bbbe1016995c7ab9a439bbe3cdeb861620647d60cceac3c7c03fcb02930908
SHA1 hash: 309bbd9091d05d13271128256f7911dff072d776
MD5 hash: 0c2c31236c125c7b0876d3d135f4b8eb
humanhash: skylark-undress-venus-xray
File name:eInvoicing_pdf.xz
Download: download sample
Signature AZORult
Create hunting rule
File size:383'214 bytes
First seen:2020-09-15 08:43:35 UTC
Last seen:Never
File type: xz
MIME type:application/x-rar
ssdeep 6144:H9ZCxF4vM73uj7xCuIMne2843wcdc68J74kKJ4d1dSRIE6IF6Z73v8F0gNrbRi:/CHrg7iMne2vBcl5UcdeR/Fq73N
TLSH 5984231A3BA63D45253B0A0EAE2E06523693196391DFDC3C72DF976D178B2EFB10D604
Reporter cocaman
Tags:xz


Avatar
cocaman
Malicious email (T1566.001)
From: "eInvoicing<contacts@zjjlnchen.com>"
Received: "from box0.zjjlnchen.com (unknown [159.203.38.77]) "
Date: "Tue, 15 Sep 2020 01:36:44 -0700"
Subject: "TNT Express Invoice: 2297456 - Account: 000011333"
Attachment: "eInvoicing_pdf.xz"

Intelligence

File Origin
# of uploads :
1
# of downloads :
78
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Heur.30693.2998.UNOFFICIAL
Create hunting rule

Detection:
n/a
Link:
https://mwdb.cert.pl/sample/fead81a27ebd2a53f2b7b986afd89279125859406c892c71b2527c793d80b615/
Threat name:
Win32.Trojan.RemcosCrypt
Create hunting rule
Status:
Malicious
First seen:
2020-09-15 08:45:05 UTC
File Type:
Binary (Archive)
Extracted files:
46
AV detection:
17 of 29 (58.62%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=72wydit6xuvfh4vxxgdk7wespejfqwkansesy4nskj6hspmawykq._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/fead81a27ebd2a53f2b7b986afd89279125859406c892c71b2527c793d80b615

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AZORult

xz fead81a27ebd2a53f2b7b986afd89279125859406c892c71b2527c793d80b615

(this sample)

AZORult

Executable exe 8c777c0ffb0097d517ed08dee3c306d7fddc7687bcb0349d5eed0a6b5c82f93a

  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 8c777c0ffb0097d517ed08dee3c306d7fddc7687bcb0349d5eed0a6b5c82f93a

Comments