General
-
Target
PO04-11-20 .pdf.exe
-
Size
68KB
-
Sample
201105-b9zcdzaxhs
-
MD5
1a6eca3f6c1965abca10f715fedc8d5f
-
SHA1
96b6196a0d0b8d6b1850d1cadcc8e76bb6f602cd
-
SHA256
89a0a6c2f66912d41d6ee18f974d100937e0d7c76588698132e29408710b4231
-
SHA512
3c4281dd307ac4ed3cfe03ec3d6e8ef599622103405200a19e91e2feb7e8ade466bf9cb366d3f0218ea46207f1e97fb4dc29b134f6c8156522d7cb1b76bd7f99
Static task
static1
Behavioral task
behavioral1
Sample
PO04-11-20 .pdf.exe
Resource
win7v20201028
Behavioral task
behavioral2
Sample
PO04-11-20 .pdf.exe
Resource
win10v20201028
Malware Config
Extracted
azorult
http://laninesolution.com/roky/PL341/index.php
Targets
-
-
Target
PO04-11-20 .pdf.exe
-
Size
68KB
-
MD5
1a6eca3f6c1965abca10f715fedc8d5f
-
SHA1
96b6196a0d0b8d6b1850d1cadcc8e76bb6f602cd
-
SHA256
89a0a6c2f66912d41d6ee18f974d100937e0d7c76588698132e29408710b4231
-
SHA512
3c4281dd307ac4ed3cfe03ec3d6e8ef599622103405200a19e91e2feb7e8ade466bf9cb366d3f0218ea46207f1e97fb4dc29b134f6c8156522d7cb1b76bd7f99
Score10/10-
Azorult
An information stealer that was first discovered in 2016, targeting browsing history and passwords.
-
Deletes itself
-
Loads dropped DLL
-
Reads data files stored by FTP clients
Tries to access configuration files associated with programs like FileZilla.
-
Reads user/profile data of local email clients
Email clients store some user data on disk where infostealers will often target it.
-
Reads user/profile data of web browsers
Infostealers often target stored browser data, which can include saved credentials etc.
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
JavaScript code in executable
-
Suspicious use of NtSetInformationThreadHideFromDebugger
-
Suspicious use of SetThreadContext
-