General
-
Target
2cc476342cd37570d78bd78d54801ae2387f21d4624b2.exe
-
Size
420KB
-
Sample
210723-f7mjcyct9a
-
MD5
377170928109b8cf902b223b247cab87
-
SHA1
b1a624d5735229296d55db216a154a791c79e07a
-
SHA256
2cc476342cd37570d78bd78d54801ae2387f21d4624b27dafac4f04e580f0dbe
-
SHA512
596190c50d2b9196b1c18632b10d00a42dc7758bf8f8962cb433354c88ce3984474a848c19f797792b8ba33a409993571addda174613b9e1835d055845ff7594
Static task
static1
Behavioral task
behavioral1
Sample
2cc476342cd37570d78bd78d54801ae2387f21d4624b2.exe
Resource
win7v20210410
Malware Config
Extracted
azorult
http://195.245.112.115/index.php
Extracted
oski
danielmax.ac.ug
Targets
-
-
Target
2cc476342cd37570d78bd78d54801ae2387f21d4624b2.exe
-
Size
420KB
-
MD5
377170928109b8cf902b223b247cab87
-
SHA1
b1a624d5735229296d55db216a154a791c79e07a
-
SHA256
2cc476342cd37570d78bd78d54801ae2387f21d4624b27dafac4f04e580f0dbe
-
SHA512
596190c50d2b9196b1c18632b10d00a42dc7758bf8f8962cb433354c88ce3984474a848c19f797792b8ba33a409993571addda174613b9e1835d055845ff7594
-
Azorult
An information stealer that was first discovered in 2016, targeting browsing history and passwords.
-
suricata: ET MALWARE Suspicious Zipped Filename in Outbound POST Request (Passwords.txt)
-
suricata: ET MALWARE Vidar/Arkei/Megumin/Oski Stealer Data Exfil
-
suricata: ET MALWARE Win32/AZORult V3.3 Client Checkin M1
-
suricata: ET MALWARE Win32/AZORult V3.3 Client Checkin M18
-
Downloads MZ/PE file
-
Executes dropped EXE
-
Loads dropped DLL
-
Accesses cryptocurrency files/wallets, possible credential harvesting
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Suspicious use of SetThreadContext
-