azorult

General

Target

0fd52c8b8586dfd283eb2b6acac20ed36b7887e56131bad25a61f29e321e13fc.exe
Size

541KB
Sample

201104-s67bgngm9j
MD5

dc55f8af1134c9a918550e2715011778
SHA1

1de6efb748498d8f79010c46e463cc6b69c61866
SHA256

0fd52c8b8586dfd283eb2b6acac20ed36b7887e56131bad25a61f29e321e13fc
SHA512

90aae6d8d8e8560b83f7dd6705506ea1618a5d79a28b6c73cb497798ae687f8c05f424bcae43f012533482d19f4b4f19f2975cc947a07e5c1dada90942b2ef1f

Score

10^/10

Malware Config

Extracted

Family

azorult

C2

http://ciuj.ir/donpy/index.php

Targets

- Target
  
  0fd52c8b8586dfd283eb2b6acac20ed36b7887e56131bad25a61f29e321e13fc.exe
- Size
  
  541KB
- MD5
  
  dc55f8af1134c9a918550e2715011778
- SHA1
  
  1de6efb748498d8f79010c46e463cc6b69c61866
- SHA256
  
  0fd52c8b8586dfd283eb2b6acac20ed36b7887e56131bad25a61f29e321e13fc
- SHA512
  
  90aae6d8d8e8560b83f7dd6705506ea1618a5d79a28b6c73cb497798ae687f8c05f424bcae43f012533482d19f4b4f19f2975cc947a07e5c1dada90942b2ef1f
Score

10^/10

azorult discovery infostealer spyware trojan
- Azorult
  An information stealer that was first discovered in 2016, targeting browsing history and passwords.
  trojan infostealer azorult
- Loads dropped DLL
- Reads data files stored by FTP clients
  Tries to access configuration files associated with programs like FileZilla.
  spyware
- Reads user/profile data of local email clients
  Email clients store some user data on disk where infostealers will often target it.
  spyware
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware
- Accesses cryptocurrency files/wallets, possible credential harvesting
  spyware
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- JavaScript code in executable
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

4

T1081

Discovery

Query Registry

2

T1012

System Information Discovery

1

T1082

Lateral Movement

Collection

Data from Local System

4

T1005

Exfiltration

Command and Control

Impact

Tasks

Sharing

General

Malware Config

Extracted

Targets

Loads dropped DLL

Reads data files stored by FTP clients

Reads user/profile data of local email clients

Reads user/profile data of web browsers

Accesses cryptocurrency files/wallets, possible credential harvesting

Checks installed software on the system

JavaScript code in executable

Suspicious use of SetThreadContext

MITRE ATT&CK Matrix ATT&CK v6

Tasks

static1

behavioral1

behavioral2