General

  • Target

    #PO - NHM4500737680MHP.exe

  • Size

    772KB

  • Sample

    210428-vrzeqg6z1n

  • MD5

    d8eaf9779ee87f05f529886275525256

  • SHA1

    1a48704cc10874e0ba88a01a68e635b6e2d10183

  • SHA256

    d286ce0a72c3053c61909e492d314b3008ca872a80ea60e29b9d0ec728e6dc62

  • SHA512

    a173fcc3789f95ac670d73be7798c0b2773964c807e683b69ef63ea6ddbc60d3ae9be9996e372ce5182725458d4af62086bd3798f2e68e31d9a52294127db9cc

Malware Config

Extracted

Family

azorult

C2

http://13.233.97.208/index.php

Targets

    • Target

      #PO - NHM4500737680MHP.exe

    • Size

      772KB

    • MD5

      d8eaf9779ee87f05f529886275525256

    • SHA1

      1a48704cc10874e0ba88a01a68e635b6e2d10183

    • SHA256

      d286ce0a72c3053c61909e492d314b3008ca872a80ea60e29b9d0ec728e6dc62

    • SHA512

      a173fcc3789f95ac670d73be7798c0b2773964c807e683b69ef63ea6ddbc60d3ae9be9996e372ce5182725458d4af62086bd3798f2e68e31d9a52294127db9cc

    • Azorult

      An information stealer that was first discovered in 2016, targeting browsing history and passwords.

    • Suspicious use of SetThreadContext

MITRE ATT&CK Matrix

Tasks