General

  • Target

    PO04-11-20 .pdf.exe

  • Size

    68KB

  • Sample

    201105-b9zcdzaxhs

  • MD5

    1a6eca3f6c1965abca10f715fedc8d5f

  • SHA1

    96b6196a0d0b8d6b1850d1cadcc8e76bb6f602cd

  • SHA256

    89a0a6c2f66912d41d6ee18f974d100937e0d7c76588698132e29408710b4231

  • SHA512

    3c4281dd307ac4ed3cfe03ec3d6e8ef599622103405200a19e91e2feb7e8ade466bf9cb366d3f0218ea46207f1e97fb4dc29b134f6c8156522d7cb1b76bd7f99

Malware Config

Extracted

Family

azorult

C2

http://laninesolution.com/roky/PL341/index.php

Targets

    • Target

      PO04-11-20 .pdf.exe

    • Size

      68KB

    • MD5

      1a6eca3f6c1965abca10f715fedc8d5f

    • SHA1

      96b6196a0d0b8d6b1850d1cadcc8e76bb6f602cd

    • SHA256

      89a0a6c2f66912d41d6ee18f974d100937e0d7c76588698132e29408710b4231

    • SHA512

      3c4281dd307ac4ed3cfe03ec3d6e8ef599622103405200a19e91e2feb7e8ade466bf9cb366d3f0218ea46207f1e97fb4dc29b134f6c8156522d7cb1b76bd7f99

    • Azorult

      An information stealer that was first discovered in 2016, targeting browsing history and passwords.

    • Deletes itself

    • Loads dropped DLL

    • Reads data files stored by FTP clients

      Tries to access configuration files associated with programs like FileZilla.

    • Reads user/profile data of local email clients

      Email clients store some user data on disk where infostealers will often target it.

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

    • JavaScript code in executable

    • Suspicious use of NtSetInformationThreadHideFromDebugger

    • Suspicious use of SetThreadContext

MITRE ATT&CK Matrix ATT&CK v6

Credential Access

Credentials in Files

3
T1081

Discovery

Query Registry

2
T1012

System Information Discovery

1
T1082

Collection

Data from Local System

3
T1005

Tasks