azorult

Sharing

Copy URL

Twitter E-mail

General

Target

Xforce_keygen_by_KeygenNinja.zip
Size

4.6MB
Sample

210324-h8v1t7a6a2
MD5

f3c2634cc47f8b6db7e8a9c434a7bd1b
SHA1

1117c75594a0c5d524800f20fcc2c9825479978f
SHA256

35ae792ed68c326831f8619948943e24791095c33297188957fd95d22a8f33ad
SHA512

07ce7f1e8182cc74fabc9b714a98b453279d19581dc25d9bbcae46804aef561de1bfad11ae1c489969cbcb3a4be1ff97a756b3039dc0c70b8531c2b7b056f747

Malware Config

Extracted

Family

azorult

http://kvaka.li/1210776429.php

Extracted

Family

fickerstealer

lukkeze.club:80

Extracted

Language

ps1

Deobfuscated

URLs

ps1.dropper

http://labsclub.com/welcome

Extracted

Family

icedid

Campaign

1319278762

213podellkk.website

Extracted

Family

cryptbot

bazfr32.top

morwhy03.top

Attributes

payload_url
http://akrvt04.top/download.php?file=lv.exe

Extracted

Family

metasploit

Version

windows/single_exec

Extracted

Family

danabot

Version

1765

Botnet

192.161.48.5:443

23.106.123.117:443

192.236.146.203:443

193.34.167.88:443

Attributes

embedded_hash
B2585F6479280F48B64C99F950BBF36D

rsa_pubkey.plain

Targets

- Target
  
  Xforce_keygen_by_KeygenNinja.exe
- Size
  
  4.7MB
- MD5
  
  741e26b12183302aa98487e9b52680dc
- SHA1
  
  e06804bb7c5dfe25124cd19078052841e92d20be
- SHA256
  
  d4e5bc7e8ea150b4d8c2dba276f4edc5b1d8ac35249e96ceb97144f91c993972
- SHA512
  
  61c1023da43ecb97f41fa9330af3aecc25fab1ae64b9f1cbb638d468bfc4ffde19f577e86af81ad869e08ed56546d4369a8add5e7eb43c474e962bc4f498a59d
Score

10^/10

azorult fickerstealer evasion infostealer persistence trojan cryptbot glupteba icedid metasploit pony vidar xmrig 1319278762 backdoor banker discovery dropper loader miner rat spyware stealer upx danabot 3
- Azorult
  An information stealer that was first discovered in 2016, targeting browsing history and passwords.
  trojan infostealer azorult
- CryptBot
  A C++ stealer distributed widely in bundle with other software.
  spyware stealer cryptbot
- CryptBot Payload
- Danabot
  Danabot is a modular banking Trojan that has been linked with other malware.
  trojan banker danabot
- Glupteba
  Glupteba is a modular loader written in Golang with various components.
  loader dropper glupteba
- Glupteba Payload
- IcedID, BokBot
  IcedID is a banking trojan capable of stealing credentials.
  trojan banker icedid
- MetaSploit
  Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.
  trojan backdoor metasploit
- Pony,Fareit
  Pony is a Remote Access Trojan application that steals information.
  rat spyware stealer pony
- Suspicious use of NtCreateProcessExOtherParentProcess
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Vidar
  Vidar is an infostealer based on Arkei stealer.
  stealer vidar
- Windows security bypass
  evasion trojan
- fickerstealer
  Ficker is an infostealer written in Rust and ASM.
  infostealer fickerstealer
- xmrig
  XMRig is a high performance, open source, cross platform CPU/GPU miner.
  miner xmrig
- ACProtect 1.3x - 1.4x DLL software
  Detects file using ACProtect software.
- Checks for common network interception software
  Looks in the registry for tools like Wireshark or Fiddler commonly used to analyze network activity.
  evasion
- IcedID First Stage Loader
  loader
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
  evasion
- Modifies boot configuration data using bcdedit
- XMRig Miner Payload
  miner
- Blocklisted process makes network request
- Downloads MZ/PE file
- Drops file in Drivers directory
- Executes dropped EXE
- Looks for VMWare Tools registry key
  evasion
- Modifies Windows Firewall
  evasion
- Possible attempt to disable PatchGuard
  Rootkits can use kernel patching to embed themselves in an operating system.
  evasion
- Sets file to hidden
  Modifies file attributes to stop it showing in Explorer etc.
  evasion
- Sets service image path in registry
  persistence
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Drops startup file
- Loads dropped DLL
- Modifies file permissions
  discovery
- Reads data files stored by FTP clients
  Tries to access configuration files associated with programs like FileZilla.
  spyware stealer
- Reads local data of messenger clients
  Infostealers often target stored data of messaging applications, which can include saved credentials and account information.
  spyware stealer
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Windows security modification
  evasion trojan
- Accesses 2FA software files, possible credential harvesting
  spyware stealer
- Accesses cryptocurrency files/wallets, possible credential harvesting
  spyware
- Adds Run key to start application
  persistence
- Checks for any installed AV software in registry
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Legitimate hosting services abused for malware hosting/C2
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- Maps connected drives based on registry
  Disk information is often read in order to detect sandboxing environments.
- Drops file in System32 directory
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
behavioral1 behavioral2 behavioral3 behavioral4