General
- Target New Case Activated CCMA Case GAJB00138471-21.pdf.exe
- Size 857KB
- Sample210222-bl583fewg6
- SHA256 aab4d0198e57e6a91a1318310347b8a9d16d7fee076211fcb9dcb5a720a2fc71
Score
10/10
Malware Config
Targets
-
- Target New Case Activated CCMA Case GAJB00138471-21.pdf.exe
- Size 857KB
- SHA256 aab4d0198e57e6a91a1318310347b8a9d16d7fee076211fcb9dcb5a720a2fc71
Score10/10Azorult
An information stealer that was first discovered in 2016, targeting browsing history and passwords.
Deletes itself
Loads dropped DLL
Obfuscated with Agile.Net obfuscator
Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.
Reads data files stored by FTP clients
Tries to access configuration files associated with programs like FileZilla.
Reads user/profile data of local email clients
Email clients store some user data on disk where infostealers will often target it.
Reads user/profile data of web browsers
Infostealers often target stored browser data, which can include saved credentials etc.
Accesses cryptocurrency files/wallets, possible credential harvesting
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
Suspicious use of SetThreadContext