azorult

General

Target
A4C57DF59F0C85EEBCB7B40263D8C3DE037F41B7D2D43.exe
Size 2.5MB
Sample210607-scy54el73j
SHA256 a4c57df59f0c85eebcb7b40263d8c3de037f41b7d2d43b6d34e7baf72a2e1448
MD5 7190324e3ae89886619d92f2e632395e
SHA1 1cbf86c566c48f60e053784dec2c1c997d5dafac
SHA512 32dcf244419fc2ba98d192e2545d5e05f49140800ffcfe8112aab01c3bc76fa9ad470bc600a0ac0d5091ec5461d845d52485ef9a6cd659f1fa6c994774e1c7f4
MD5 SHA1 SHA512

Score

10^/10

Malware Config

Extracted

Family

azorult

C2

http://185.212.128.68/newpan/index.php

Targets

- Target
  A4C57DF59F0C85EEBCB7B40263D8C3DE037F41B7D2D43.exe
- Size 2.5MB
- SHA256 a4c57df59f0c85eebcb7b40263d8c3de037f41b7d2d43b6d34e7baf72a2e1448
- MD5 7190324e3ae89886619d92f2e632395e
- SHA1 1cbf86c566c48f60e053784dec2c1c997d5dafac
- SHA512 32dcf244419fc2ba98d192e2545d5e05f49140800ffcfe8112aab01c3bc76fa9ad470bc600a0ac0d5091ec5461d845d52485ef9a6cd659f1fa6c994774e1c7f4
- MD5 SHA1 SHA512
Score

10^/10

azorult discovery infostealer trojan
- Azorult
  An information stealer that was first discovered in 2016, targeting browsing history and passwords.
  trojan infostealer azorult
- Executes dropped EXE
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Loads dropped DLL
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Query Registry

2

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Targets

Executes dropped EXE

Checks computer location settings

Loads dropped DLL

Checks installed software on the system

MITRE ATT&CK Enterprise v6

Tasks

static1

behavioral1

behavioral2