azorult | 5e76ff3a2c09d0d23c33ea120c80e84c72e0ef705b03c1106056399e620effa2 | Triage

Submit
Reports

Overview

overview

Static

static

5e76ff3a2c...a2.exe

windows7_x64

5e76ff3a2c...a2.exe

windows10_x64

Sharing

General

Target

5e76ff3a2c09d0d23c33ea120c80e84c72e0ef705b03c1106056399e620effa2
Size

656KB
Sample

201112-2nehwfgzyx
MD5

caef8427511572beb9943b7b7db02687
SHA1

0830dcb74594d043d2d23bca12377a92753fee7f
SHA256

5e76ff3a2c09d0d23c33ea120c80e84c72e0ef705b03c1106056399e620effa2
SHA512

eaa9ffd0e9ff9448efa20375858122d39a72b1d9ed91547403bb10a3d07284acba31a946c21196b7d9f6a526d0cce8019e094e9b39e06898ee8b2f778a5403ec

Score

10^/10

azorult betabot backdoor botnet evasion infostealer persistence trojan

Static task

static1

Behavioral task

behavioral1

Sample

5e76ff3a2c09d0d23c33ea120c80e84c72e0ef705b03c1106056399e620effa2.exe

Resource

win7v20201028

azorult betabot backdoor botnet evasion infostealer persistence trojan

windows7_x64

0 signatures

0 seconds

Behavioral task

behavioral2

Sample

5e76ff3a2c09d0d23c33ea120c80e84c72e0ef705b03c1106056399e620effa2.exe

Resource

win10v20201028

azorult betabot backdoor botnet evasion infostealer persistence trojan

windows10_x64

0 signatures

0 seconds

Malware Config

Extracted

Family

azorult

C2

http://tong-honq.com/azo/amon/index.php

Targets

- Target
  
  5e76ff3a2c09d0d23c33ea120c80e84c72e0ef705b03c1106056399e620effa2
- Size
  
  656KB
- MD5
  
  caef8427511572beb9943b7b7db02687
- SHA1
  
  0830dcb74594d043d2d23bca12377a92753fee7f
- SHA256
  
  5e76ff3a2c09d0d23c33ea120c80e84c72e0ef705b03c1106056399e620effa2
- SHA512
  
  eaa9ffd0e9ff9448efa20375858122d39a72b1d9ed91547403bb10a3d07284acba31a946c21196b7d9f6a526d0cce8019e094e9b39e06898ee8b2f778a5403ec
Score

10^/10

azorult betabot backdoor botnet evasion infostealer persistence trojan
- Azorult
  An information stealer that was first discovered in 2016, targeting browsing history and passwords.
  trojan infostealer azorult
- BetaBot
  Beta Bot is a Trojan that infects computers and disables Antivirus.
  trojan backdoor botnet betabot
- Modifies firewall policy service
  evasion
- Executes dropped EXE
- Sets file execution options in registry
  persistence
- Checks BIOS information in registry
  BIOS information is often read in order to detect sandboxing environments.
- Drops startup file
- Loads dropped DLL
- Adds Run key to start application
  persistence
- Checks whether UAC is enabled
  evasion trojan
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Modify Existing Service

Registry Run Keys / Startup Folder

Privilege Escalation

Defense Evasion

Modify Registry

Credential Access

Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks

static1

behavioral1

azorultbetabotbackdoorbotnetevasioninfostealerpersistencetrojan

behavioral2

azorultbetabotbackdoorbotnetevasioninfostealerpersistencetrojan

© 2018-2024

Terms | Privacy