General
-
Target
gunzipped.exe
-
Size
879KB
-
Sample
210408-qx5dvxyqmj
-
MD5
1e214794b9698010528681d8a7218b27
-
SHA1
e5ead869d987721f2fe57f92761bfa0211f13cd1
-
SHA256
552dfc754e6cdb214ed63e71645340e3e61f006b4472ec33afd6c753ed311a99
-
SHA512
088112b695f412a84b154aed8855327e89a24475b9bbe5c10817fcaf93bd67740f12dcc89d7a3096c0796dfce1ebf93c1c5f412472f706c5fb016ea2c3c969e2
Static task
static1
Behavioral task
behavioral1
Sample
gunzipped.exe
Resource
win7v20201028
Malware Config
Extracted
azorult
http://45.56.119.148/index.php
Targets
-
-
Target
gunzipped.exe
-
Size
879KB
-
MD5
1e214794b9698010528681d8a7218b27
-
SHA1
e5ead869d987721f2fe57f92761bfa0211f13cd1
-
SHA256
552dfc754e6cdb214ed63e71645340e3e61f006b4472ec33afd6c753ed311a99
-
SHA512
088112b695f412a84b154aed8855327e89a24475b9bbe5c10817fcaf93bd67740f12dcc89d7a3096c0796dfce1ebf93c1c5f412472f706c5fb016ea2c3c969e2
-
Azorult
An information stealer that was first discovered in 2016, targeting browsing history and passwords.
-
Loads dropped DLL
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Suspicious use of SetThreadContext
-