General

  • Target

    8d58498de34e8674d319dc578b7b5f87.exe

  • Size

    112KB

  • Sample

    201111-mxvlj5kglx

  • MD5

    8d58498de34e8674d319dc578b7b5f87

  • SHA1

    d70595f68878b2bd1a308015e1963186ca73cce8

  • SHA256

    09758dfa192e1932726afa788ef5272c035f6e95e398b20db04a68fd698e3258

  • SHA512

    ebd012b23e57ee1617aa7e15ea101c43a87b18e8108cb9c01f7096fa03829728f51effc3324499dc48964fce4f65f8b280b08896750f049e0f86462c3ef8cb6b

Malware Config

Extracted

Family

azorult

C2

https://www.themindset.org.ng/nc_assets/fonts/098/index.php

Targets

    • Target

      8d58498de34e8674d319dc578b7b5f87.exe

    • Size

      112KB

    • MD5

      8d58498de34e8674d319dc578b7b5f87

    • SHA1

      d70595f68878b2bd1a308015e1963186ca73cce8

    • SHA256

      09758dfa192e1932726afa788ef5272c035f6e95e398b20db04a68fd698e3258

    • SHA512

      ebd012b23e57ee1617aa7e15ea101c43a87b18e8108cb9c01f7096fa03829728f51effc3324499dc48964fce4f65f8b280b08896750f049e0f86462c3ef8cb6b

    • Azorult

      An information stealer that was first discovered in 2016, targeting browsing history and passwords.

    • Loads dropped DLL

    • Reads data files stored by FTP clients

      Tries to access configuration files associated with programs like FileZilla.

    • Reads user/profile data of local email clients

      Email clients store some user data on disk where infostealers will often target it.

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Accesses cryptocurrency files/wallets, possible credential harvesting

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

    • JavaScript code in executable

MITRE ATT&CK Matrix ATT&CK v6

Defense Evasion

Install Root Certificate

1
T1130

Modify Registry

1
T1112

Credential Access

Credentials in Files

4
T1081

Discovery

Query Registry

2
T1012

System Information Discovery

1
T1082

Collection

Data from Local System

4
T1005

Tasks