azorult

General

Target

Form.Studio.2009.key.generator.exe
Size

7.8MB
Sample

210727-738f9pb32x
MD5

97ba5ef12fb23c151d4c7d40b4a470f8
SHA1

6e8790b6fd485ce66b4d308eb703b8e5e66e8677
SHA256

c720af16ea629a7cef53e82c4f739a36f31103f549c5c4fbf367d58bb876a83f
SHA512

b39677238fac1e0b24c4c7265572fc5becf016dd6090391bc4a318629efb23089cfcff317107dbc34e00aecdd9b88d6ab0de6bb73db48d2678b422a53133adfc

Score

10^/10

Malware Config

Extracted

Family

azorult

C2

http://kvaka.li/1210776429.php

Targets

- Target
  
  Form.Studio.2009.key.generator.exe
- Size
  
  7.8MB
- MD5
  
  97ba5ef12fb23c151d4c7d40b4a470f8
- SHA1
  
  6e8790b6fd485ce66b4d308eb703b8e5e66e8677
- SHA256
  
  c720af16ea629a7cef53e82c4f739a36f31103f549c5c4fbf367d58bb876a83f
- SHA512
  
  b39677238fac1e0b24c4c7265572fc5becf016dd6090391bc4a318629efb23089cfcff317107dbc34e00aecdd9b88d6ab0de6bb73db48d2678b422a53133adfc
Score

10^/10

azorult redline discovery infostealer persistence spyware stealer suricata trojan vmprotect
- Azorult
  An information stealer that was first discovered in 2016, targeting browsing history and passwords.
  trojan infostealer azorult
- Process spawned unexpected child process
  This typically indicates the parent process was compromised via an exploit or macro.
- RedLine
  RedLine Stealer is a malware family written in C#, first appearing in early 2020.
  infostealer redline
- RedLine Payload
- Suspicious use of NtCreateUserProcessOtherParentProcess
- suricata: ET MALWARE Win32/AZORult V3.3 Client Checkin M3
  suricata
- Executes dropped EXE
- VMProtect packed file
  Detects executables packed with VMProtect commercial packer.
  vmprotect
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Accesses cryptocurrency files/wallets, possible credential harvesting
  spyware
- Adds Run key to start application
  persistence
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Legitimate hosting services abused for malware hosting/C2
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- Drops file in System32 directory
- Suspicious use of SetThreadContext
behavioral1 behavioral2