General

  • Target

    Ziraat Bankasi Swift Mesaji.exe

  • Size

    444KB

  • Sample

    210112-fa9yk3z7e2

  • MD5

    35c69b2c315a5b7d4fe4a2106dad3921

  • SHA1

    5f89cd2ec7ff235c54bb079740427687b028f96d

  • SHA256

    3d39fc826f6ed0115155842080406ffc82f930c5daae8ef710d3c30009fd0106

  • SHA512

    b008b1f7c9e6c2f640ada66b84348d15ecae142740fc717392300b3d83f9922171104a546f3a7f9ce4427eebb81f85ac6dee6a3c3a8dd836af17a5d84d7f8f0e

Malware Config

Extracted

Family

azorult

C2

http://itrad3r.com/24cd/index.php

Targets

    • Target

      Ziraat Bankasi Swift Mesaji.exe

    • Size

      444KB

    • MD5

      35c69b2c315a5b7d4fe4a2106dad3921

    • SHA1

      5f89cd2ec7ff235c54bb079740427687b028f96d

    • SHA256

      3d39fc826f6ed0115155842080406ffc82f930c5daae8ef710d3c30009fd0106

    • SHA512

      b008b1f7c9e6c2f640ada66b84348d15ecae142740fc717392300b3d83f9922171104a546f3a7f9ce4427eebb81f85ac6dee6a3c3a8dd836af17a5d84d7f8f0e

    • Azorult

      An information stealer that was first discovered in 2016, targeting browsing history and passwords.

    • Executes dropped EXE

    • Loads dropped DLL

    • Suspicious use of SetThreadContext

MITRE ATT&CK Matrix

Tasks