Overview

overview

10

Static

static

034.exe

windows7_x64

10

034.exe

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    034

  • Size

    391KB

  • Sample

    210728-qm4wmxtbps

  • MD5

    2763355e57b326d3b984f0ac394f7ac6

  • SHA1

    ceb54e6f4b044fe78e4acd5e2935831118d57baf

  • SHA256

    dcbd6522b7ba8bfb856038cf4dcb24782cab61a9e3ce15bbf9afcdff9c6c4f4a

  • SHA512

    6b402d5ee4ab1213ddd054f4478ff5cd81a01f75b9327fc8e3d09309cf42b811a998ae96ad0c3fe8ee8e2b9fce994f227ed3bdc74a1e7ae9658108061628e13a

Score
10/10
azorultdiscoveryinfostealersuricatatrojan

Malware Config

Extracted

Family

azorult

C2

https://www.nirjhara.com/mine/32/index.php

Targets

    • Target

      034

    • Size

      391KB

    • MD5

      2763355e57b326d3b984f0ac394f7ac6

    • SHA1

      ceb54e6f4b044fe78e4acd5e2935831118d57baf

    • SHA256

      dcbd6522b7ba8bfb856038cf4dcb24782cab61a9e3ce15bbf9afcdff9c6c4f4a

    • SHA512

      6b402d5ee4ab1213ddd054f4478ff5cd81a01f75b9327fc8e3d09309cf42b811a998ae96ad0c3fe8ee8e2b9fce994f227ed3bdc74a1e7ae9658108061628e13a

    Score
    10/10
    azorultdiscoveryinfostealersuricatatrojan

    • Azorult

      An information stealer that was first discovered in 2016, targeting browsing history and passwords.

      trojaninfostealerazorult

    • suricata: ET MALWARE Win32/AZORult V3.2 Client Checkin M1

      suricata

    • suricata: ET MALWARE Win32/AZORult V3.2 Client Checkin M17

      suricata

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

2
T1012

System Information Discovery

1
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks