General
-
Target
b0ca5198d12b8855c96897e6b3198105cf363a790bf104afa7ed6421322c07a2.exe
-
Size
808KB
-
Sample
210421-qapgygfvr2
-
MD5
4d23229aaae673afff26dc907c11541c
-
SHA1
a4536d34592a510279f63d6d903dc4b6ba9f9c6c
-
SHA256
b0ca5198d12b8855c96897e6b3198105cf363a790bf104afa7ed6421322c07a2
-
SHA512
dd20f835303a17350adb51d42033398962fad1a103e87c930f30ea9148be327a5f84b4cf879f9d351aa4f5ed53dae64a4168721f7baad378cf624a171c1e7033
Static task
static1
Behavioral task
behavioral1
Sample
b0ca5198d12b8855c96897e6b3198105cf363a790bf104afa7ed6421322c07a2.exe
Resource
win7v20210410
Behavioral task
behavioral2
Sample
b0ca5198d12b8855c96897e6b3198105cf363a790bf104afa7ed6421322c07a2.exe
Resource
win10v20210410
Malware Config
Extracted
azorult
http://31.210.20.121/index.php
Targets
-
-
Target
b0ca5198d12b8855c96897e6b3198105cf363a790bf104afa7ed6421322c07a2.exe
-
Size
808KB
-
MD5
4d23229aaae673afff26dc907c11541c
-
SHA1
a4536d34592a510279f63d6d903dc4b6ba9f9c6c
-
SHA256
b0ca5198d12b8855c96897e6b3198105cf363a790bf104afa7ed6421322c07a2
-
SHA512
dd20f835303a17350adb51d42033398962fad1a103e87c930f30ea9148be327a5f84b4cf879f9d351aa4f5ed53dae64a4168721f7baad378cf624a171c1e7033
-
Azorult
An information stealer that was first discovered in 2016, targeting browsing history and passwords.
-
Loads dropped DLL
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Suspicious use of SetThreadContext
-