azorult

General

Target

adobe_illustrator_keygen_by_KeygenNinja.exe
Size

8.2MB
Sample

210309-4zmk9kzwta
MD5

9d138fc7214e3406cfc203e4922ab3ac
SHA1

3ec42683d6cd31870a54991386d2ca596f9cdeff
SHA256

ec624715737071e22af8152d2170cb7a04217b3815a00302ff6f534994a7a97b
SHA512

06414e7259ef270ebb668fcb628ee25e3cb265b64b5baba8fc842c45b8e31cb88cea4934b420cb27e7849ee87e62172b44416fff46ab43b5cd4be24dd6048f8b

Score

10^/10

Malware Config

Extracted

Family

azorult

C2

http://kvaka.li/1210776429.php

Targets

- Target
  
  adobe_illustrator_keygen_by_KeygenNinja.exe
- Size
  
  8.2MB
- MD5
  
  9d138fc7214e3406cfc203e4922ab3ac
- SHA1
  
  3ec42683d6cd31870a54991386d2ca596f9cdeff
- SHA256
  
  ec624715737071e22af8152d2170cb7a04217b3815a00302ff6f534994a7a97b
- SHA512
  
  06414e7259ef270ebb668fcb628ee25e3cb265b64b5baba8fc842c45b8e31cb88cea4934b420cb27e7849ee87e62172b44416fff46ab43b5cd4be24dd6048f8b
Score

10^/10

azorult plugx pony redline bootkit discovery infostealer macro persistence rat spyware stealer trojan xlm
- Azorult
  An information stealer that was first discovered in 2016, targeting browsing history and passwords.
  trojan infostealer azorult
- PlugX
  PlugX is a RAT (Remote Access Trojan) that has been around since 2008.
  trojan plugx
- Pony,Fareit
  Pony is a Remote Access Trojan application that steals information.
  rat spyware stealer pony
- RedLine
  RedLine Stealer is a malware family written in C#, first appearing in early 2020.
  infostealer redline
- RedLine Payload
- Executes dropped EXE
- Suspicious Office macro
  Office document equipped with 4.0 macros.
  macro xlm
- Loads dropped DLL
- Reads data files stored by FTP clients
  Tries to access configuration files associated with programs like FileZilla.
  spyware
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware
- Accesses cryptocurrency files/wallets, possible credential harvesting
  spyware
- Adds Run key to start application
  persistence
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Legitimate hosting services abused for malware hosting/C2
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- Writes to the Master Boot Record (MBR)
  Bootkits write to the MBR to gain persistence at a level below the operating system.
  bootkit persistence
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
behavioral1 behavioral2