General
- Target Ziraat Bankasi Swift Mesaji.exe
- Size 444KB
- Sample210112-fa9yk3z7e2
- SHA256 3d39fc826f6ed0115155842080406ffc82f930c5daae8ef710d3c30009fd0106
- MD5 35c69b2c315a5b7d4fe4a2106dad3921
- SHA1 5f89cd2ec7ff235c54bb079740427687b028f96d
- SHA512 b008b1f7c9e6c2f640ada66b84348d15ecae142740fc717392300b3d83f9922171104a546f3a7f9ce4427eebb81f85ac6dee6a3c3a8dd836af17a5d84d7f8f0e
- MD5 SHA1 SHA512
Score
10/10
Static task
static1
Behavioral task
behavioral1
Sample
Ziraat Bankasi Swift Mesaji.exe
Resource
win7v20201028
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
Ziraat Bankasi Swift Mesaji.exe
Resource
win10v20201028
0 signatures
0 seconds
Malware Config
Extracted
Family
-
azorult
C2
-
http://itrad3r.com/24cd/index.php
Targets
-
- Target Ziraat Bankasi Swift Mesaji.exe
- Size 444KB
- SHA256 3d39fc826f6ed0115155842080406ffc82f930c5daae8ef710d3c30009fd0106
- MD5 35c69b2c315a5b7d4fe4a2106dad3921
- SHA1 5f89cd2ec7ff235c54bb079740427687b028f96d
- SHA512 b008b1f7c9e6c2f640ada66b84348d15ecae142740fc717392300b3d83f9922171104a546f3a7f9ce4427eebb81f85ac6dee6a3c3a8dd836af17a5d84d7f8f0e
- MD5 SHA1 SHA512
Score10/10-
Azorult
An information stealer that was first discovered in 2016, targeting browsing history and passwords.
-
Executes dropped EXE
-
Loads dropped DLL
-
Suspicious use of SetThreadContext