Overview

overview

10

Static

static

1

GRS66701.exe

windows7_x64

10

GRS66701.exe

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    GRS66701.exe

  • Size

    151KB

  • Sample

    210407-5zwj738266

  • MD5

    390ac19e8d4b6eba1a936a5052b6babf

  • SHA1

    1700afbdafcf20ee9deeee4165f6758403e7f43a

  • SHA256

    9aee92df3530cb75fb37ffe332199dc0a61718a010d34fc48dbbe16fdd1b3154

  • SHA512

    b876561ce26fafe4b7a4423c8a992bac48625eb68a540608a499d0b3920841666d01dd83f85f669fafd960ef1e10c7395578107174a33a799d4e542f3faf05a7

Score
10/10
azorultinfostealertrojan

Malware Config

Extracted

Family

azorult

C2

http://staging.onyxa.pl/XyuTr/index.php

Targets

    • Target

      GRS66701.exe

    • Size

      151KB

    • MD5

      390ac19e8d4b6eba1a936a5052b6babf

    • SHA1

      1700afbdafcf20ee9deeee4165f6758403e7f43a

    • SHA256

      9aee92df3530cb75fb37ffe332199dc0a61718a010d34fc48dbbe16fdd1b3154

    • SHA512

      b876561ce26fafe4b7a4423c8a992bac48625eb68a540608a499d0b3920841666d01dd83f85f669fafd960ef1e10c7395578107174a33a799d4e542f3faf05a7

    Score
    10/10
    azorultinfostealertrojan

    • Azorult

      An information stealer that was first discovered in 2016, targeting browsing history and passwords.

      trojaninfostealerazorult

    • Loads dropped DLL

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks