azorult

General

Target

Tebis_CAD_CAM_v3_keygen.zip
Size

8.4MB
Sample

210305-27rqlcnp4a
MD5

b5c0c5291c8520d8c53b3dfec2a8c310
SHA1

7205610bb43df5a3659136ca7704fdb586dfa1fa
SHA256

02d80acbf3f43d21a3cfef735e500e316701780be2849d67a6fdbc541b467bb9
SHA512

f6bed3d827de990e5741f40aab6538701a43b6f8c1051b6ff39e2fd026054d9947eb2a0feb9f11003dde156d8f6af0fb6ab2b2da8aa8337b1213bb7a56cc31d3

Score

10^/10

Malware Config

Extracted

Family

azorult

C2

http://kvaka.li/1210776429.php

Extracted

Family

raccoon

Botnet

51c194bfb6e404af0e5ff0b93b443907a6a845b1

Attributes

url4cnc
https://telete.in/h_focus_1

rc4.plain

Targets

- Target
  
  Tebis_CAD_CAM_v3_keygen.exe
- Size
  
  8.6MB
- MD5
  
  d46996fb525c7f4fdfaea7b01c7e6d38
- SHA1
  
  064b4deac49cc4d633f1d287a5b6164d0bf9ea02
- SHA256
  
  948472e002f81ae18b98a14df1785c22c0b5c0c1f14f2b0caf1f5887493765c9
- SHA512
  
  b5ae0719d1e46bba31c80288855ab82e0020cf353d472985f2eee23cc1d95602bf2cb5f1c0bc80c6f6829532e927d7afba4bc684e52e856ed6dcafe92fce2a83
Score

10^/10

azorult elysiumstealer plugx pony bootkit discovery infostealer macro persistence rat spyware stealer trojan xlm raccoon redline vidar 51c194bfb6e404af0e5ff0b93b443907a6a845b1 evasion
- Azorult
  An information stealer that was first discovered in 2016, targeting browsing history and passwords.
  trojan infostealer azorult
- ElysiumStealer
  ElysiumStealer (previously known as ZeromaxStealer) is an info stealer that can steal login credentials for various accounts.
  stealer elysiumstealer
- ElysiumStealer Payload
- PlugX
  PlugX is a RAT (Remote Access Trojan) that has been around since 2008.
  trojan plugx
- Pony,Fareit
  Pony is a Remote Access Trojan application that steals information.
  rat spyware stealer pony
- Raccoon
  Simple but powerful infostealer which was very active in 2019.
  stealer raccoon
- RedLine
  RedLine Stealer is a malware family written in C#, first appearing in early 2020.
  infostealer redline
- RedLine Payload
- Vidar
  Vidar is an infostealer based on Arkei stealer.
  stealer vidar
- Checks for common network interception software
  Looks in the registry for tools like Wireshark or Fiddler commonly used to analyze network activity.
  evasion
- Nirsoft
- Executes dropped EXE
- Suspicious Office macro
  Office document equipped with 4.0 macros.
  macro xlm
- Loads dropped DLL
- Reads data files stored by FTP clients
  Tries to access configuration files associated with programs like FileZilla.
  spyware
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware
- Accesses cryptocurrency files/wallets, possible credential harvesting
  spyware
- Adds Run key to start application
  persistence
- Checks for any installed AV software in registry
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Checks whether UAC is enabled
  evasion trojan
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Legitimate hosting services abused for malware hosting/C2
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- Maps connected drives based on registry
  Disk information is often read in order to detect sandboxing environments.
- Writes to the Master Boot Record (MBR)
  Bootkits write to the MBR to gain persistence at a level below the operating system.
  bootkit persistence
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
behavioral1 behavioral2