azorult

General

Target

Minitool_Partition_Wizard_serials_keygen_by_orion.zip
Size

6.2MB
Sample

210718-r6nners86s
MD5

6b8f5d8439b480145049420e9ae35628
SHA1

320f3a2cb10d9a095e16a73451f7ee142ca39561
SHA256

e555ec0d2a16e4c6d3e17e9d3d3edfa7cbe9b98b133d84b42c155f7e31aaf951
SHA512

b40a7e6e1564e41a6bc96984f587e9b84cf77ec0984016b30d64887201f7ffa0bf6ce08fc55d759cc8df4a5ffdfd96654565c5a658dbb4e4a566ef16eb25ed90

Score

10^/10

azorult pony redline 1 discovery evasion infostealer persistence rat spyware stealer trojan upx vmprotect

Malware Config

Extracted

Family

azorult

C2

http://kvaka.li/1210776429.php

Extracted

Family

pony

C2

http://www.oldhorse.info

Extracted

Family

redline

Botnet

1

C2

neoulinade.xyz:80

Targets

- Target
  
  Minitool_Partition_Wizard_serials_keygen_by_orion.exe
- Size
  
  6.3MB
- MD5
  
  47a0606fd21945f6890b763327f95964
- SHA1
  
  deb25d02d77bbd01d0602ddceb31de656be49b7e
- SHA256
  
  efaa90461c40e5cfb82717e9a01f6983f84491a21f79f20366801b257e0dc4eb
- SHA512
  
  d5027be4201c9d4519f6d068c2e83488a2274553d1178b48e940a71bfd0187530ed0f728a3f141bd82b8a612a6829d6fc571e47a99469fa68ab6a6f7013657d1
Score

10^/10

azorult pony redline 1 discovery infostealer persistence rat spyware stealer trojan vmprotect evasion upx
- Azorult
  An information stealer that was first discovered in 2016, targeting browsing history and passwords.
  trojan infostealer azorult
- Pony,Fareit
  Pony is a Remote Access Trojan application that steals information.
  rat spyware stealer pony
- Process spawned unexpected child process
  This typically indicates the parent process was compromised via an exploit or macro.
- RedLine
  RedLine Stealer is a malware family written in C#, first appearing in early 2020.
  infostealer redline
- RedLine Payload
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Executes dropped EXE
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
- VMProtect packed file
  Detects executables packed with VMProtect commercial packer.
  vmprotect
- Loads dropped DLL
- Reads data files stored by FTP clients
  Tries to access configuration files associated with programs like FileZilla.
  spyware stealer
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Accesses cryptocurrency files/wallets, possible credential harvesting
  spyware
- Adds Run key to start application
  persistence
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Checks whether UAC is enabled
  evasion trojan
- Legitimate hosting services abused for malware hosting/C2
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- Drops file in System32 directory
- Suspicious use of NtCreateThreadExHideFromDebugger
- Suspicious use of SetThreadContext
behavioral1 behavioral2