General
-
Target
e-dekont.html.exe
-
Size
737KB
-
Sample
210407-tnefvlywzj
-
MD5
79c88f12c48f8307763bcba87f443337
-
SHA1
af17a6229b33656e042160cbbd335e1479e29acf
-
SHA256
fe4e3fc81c2e5028cde6ef0a91ac901fa6b5e0e5e2cd6d68070a9f45cc3a4b69
-
SHA512
b7a1d650fd25fbd484ac3856fe49d1b1228bbec3b175a383151a3bb78c12510fa10b9fb1af6c177f9f6dd544739f2727b5aaa88766b5d2c258874ffea60fc308
Static task
static1
Behavioral task
behavioral1
Sample
e-dekont.html.exe
Resource
win7v20201028
Malware Config
Extracted
azorult
http://alfawood.us/mkdgs/index.php
Targets
-
-
Target
e-dekont.html.exe
-
Size
737KB
-
MD5
79c88f12c48f8307763bcba87f443337
-
SHA1
af17a6229b33656e042160cbbd335e1479e29acf
-
SHA256
fe4e3fc81c2e5028cde6ef0a91ac901fa6b5e0e5e2cd6d68070a9f45cc3a4b69
-
SHA512
b7a1d650fd25fbd484ac3856fe49d1b1228bbec3b175a383151a3bb78c12510fa10b9fb1af6c177f9f6dd544739f2727b5aaa88766b5d2c258874ffea60fc308
-
Azorult
An information stealer that was first discovered in 2016, targeting browsing history and passwords.
-
Deletes itself
-
Loads dropped DLL
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Suspicious use of SetThreadContext
-