General

  • Target

    new order 556879.exe

  • Size

    37KB

  • Sample

    210426-29821p55n6

  • MD5

    9b8e5c6496f954ce037e11f7a6463b21

  • SHA1

    8787abcb44ee0ffade8007d7a5783d84e3c7ae16

  • SHA256

    3938b573134eabe9228b7f4cf6a433fc42846a8aa53060072b15efe955bc9f93

  • SHA512

    0e1984d931360eef54aa2aa0ec3980ed5b8cc5a8f26543ecd4c0ad3557b84054381aa7fe73cfd69ac65d98493d5817f4fd5ba0f153c5ae60a607b670a3a8e69e

Malware Config

Extracted

Family

azorult

C2

http://195.245.112.115/index.php

Targets

    • Target

      new order 556879.exe

    • Size

      37KB

    • MD5

      9b8e5c6496f954ce037e11f7a6463b21

    • SHA1

      8787abcb44ee0ffade8007d7a5783d84e3c7ae16

    • SHA256

      3938b573134eabe9228b7f4cf6a433fc42846a8aa53060072b15efe955bc9f93

    • SHA512

      0e1984d931360eef54aa2aa0ec3980ed5b8cc5a8f26543ecd4c0ad3557b84054381aa7fe73cfd69ac65d98493d5817f4fd5ba0f153c5ae60a607b670a3a8e69e

    • Azorult

      An information stealer that was first discovered in 2016, targeting browsing history and passwords.

    • Loads dropped DLL

    • Reads data files stored by FTP clients

      Tries to access configuration files associated with programs like FileZilla.

    • Reads local data of messenger clients

      Infostealers often target stored data of messaging applications, which can include saved credentials and account information.

    • Reads user/profile data of local email clients

      Email clients store some user data on disk where infostealers will often target it.

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Accesses cryptocurrency files/wallets, possible credential harvesting

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

    • Suspicious use of NtSetInformationThreadHideFromDebugger

    • Suspicious use of SetThreadContext

MITRE ATT&CK Matrix ATT&CK v6

Credential Access

Credentials in Files

5
T1081

Discovery

Query Registry

2
T1012

System Information Discovery

2
T1082

Collection

Data from Local System

5
T1005

Tasks