General

  • Target

    8c48a2f0aa0403e96690e4f44e37caf8cdfc46a2435bda060d957cd55312fe91

  • Size

    738KB

  • Sample

    210515-fawyhd3m2x

  • MD5

    bc4a5ca7b0a92b47712b17dc6785b0b2

  • SHA1

    f770a906bef618fb4d38ccfe1b0503746ac8403a

  • SHA256

    8c48a2f0aa0403e96690e4f44e37caf8cdfc46a2435bda060d957cd55312fe91

  • SHA512

    ce025646b46327f51b91f6d743f4ff74b71244e9a4601d2b53d104b4c1445a1231527e254864b8f502f867ec477d2e6956ab8e713c87a1077578072b7391c43e

Malware Config

Extracted

Family

azorult

C2

http://www.lootchem.com/nams/Panel/index.php

Targets

    • Target

      8c48a2f0aa0403e96690e4f44e37caf8cdfc46a2435bda060d957cd55312fe91

    • Size

      738KB

    • MD5

      bc4a5ca7b0a92b47712b17dc6785b0b2

    • SHA1

      f770a906bef618fb4d38ccfe1b0503746ac8403a

    • SHA256

      8c48a2f0aa0403e96690e4f44e37caf8cdfc46a2435bda060d957cd55312fe91

    • SHA512

      ce025646b46327f51b91f6d743f4ff74b71244e9a4601d2b53d104b4c1445a1231527e254864b8f502f867ec477d2e6956ab8e713c87a1077578072b7391c43e

    • Azorult

      An information stealer that was first discovered in 2016, targeting browsing history and passwords.

    • Drops startup file

    • Suspicious use of SetThreadContext

MITRE ATT&CK Matrix

Tasks