azorult

General

Target

A6762497ACF6D35D8122A9990832CE0B.exe
Size

3.8MB
Sample

210829-tm9wr95m26
MD5

a6762497acf6d35d8122a9990832ce0b
SHA1

532703ddfa102fd99087d34853ad915144230ec0
SHA256

84a40405e621a10c9259ff45e052fab0789a6ff956eb95985a12d715d64e5b72
SHA512

b8adef7056fb8f4aada7972852b91beff0e677dff7678a20df7ac70c0a8c2a3ad374c68f91cec4b9f6e4e4903e7be01c9067c04e656ac1b2459efa6a72b38691

Score

10^/10

Malware Config

Extracted

Family

azorult

C2

http://195.245.112.115/index.php

Extracted

Family

raccoon

Botnet

c81fb6015c832710f869f6911e1aec18747e0184

Attributes

url4cnc
https://telete.in/brikitiki

rc4.plain

Extracted

Family

oski

C2

hsagoi.ac.ug

Targets

- Target
  
  A6762497ACF6D35D8122A9990832CE0B.exe
- Size
  
  3.8MB
- MD5
  
  a6762497acf6d35d8122a9990832ce0b
- SHA1
  
  532703ddfa102fd99087d34853ad915144230ec0
- SHA256
  
  84a40405e621a10c9259ff45e052fab0789a6ff956eb95985a12d715d64e5b72
- SHA512
  
  b8adef7056fb8f4aada7972852b91beff0e677dff7678a20df7ac70c0a8c2a3ad374c68f91cec4b9f6e4e4903e7be01c9067c04e656ac1b2459efa6a72b38691
Score

10^/10

azorult oski raccoon c81fb6015c832710f869f6911e1aec18747e0184 discovery infostealer spyware stealer suricata trojan
- Azorult
  An information stealer that was first discovered in 2016, targeting browsing history and passwords.
  trojan infostealer azorult
- Oski
  Oski is an infostealer targeting browser data, crypto wallets.
  infostealer oski
- Raccoon
  Simple but powerful infostealer which was very active in 2019.
  stealer raccoon
- suricata: ET MALWARE Suspicious Zipped Filename in Outbound POST Request (Passwords.txt)
  suricata: ET MALWARE Suspicious Zipped Filename in Outbound POST Request (Passwords.txt)
  suricata
- suricata: ET MALWARE Vidar/Arkei/Megumin/Oski Stealer Data Exfil
  suricata: ET MALWARE Vidar/Arkei/Megumin/Oski Stealer Data Exfil
  suricata
- suricata: ET MALWARE Win32/AZORult V3.3 Client Checkin M18
  suricata: ET MALWARE Win32/AZORult V3.3 Client Checkin M18
  suricata
- suricata: ET MALWARE Win32/AZORult V3.3 Client Checkin M3
  suricata: ET MALWARE Win32/AZORult V3.3 Client Checkin M3
  suricata
- Downloads MZ/PE file
- Executes dropped EXE
- Loads dropped DLL
- Reads data files stored by FTP clients
  Tries to access configuration files associated with programs like FileZilla.
  spyware stealer
- Reads local data of messenger clients
  Infostealers often target stored data of messaging applications, which can include saved credentials and account information.
  spyware stealer
- Reads user/profile data of local email clients
  Email clients store some user data on disk where infostealers will often target it.
  spyware stealer
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Accesses cryptocurrency files/wallets, possible credential harvesting
  spyware
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Suspicious use of SetThreadContext
behavioral1 behavioral2