Overview

overview

10

Static

static

ORDER WORKBOOK.exe

windows7_x64

1

ORDER WORKBOOK.exe

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    ORDER WORKBOOK.gz

  • Size

    481KB

  • Sample

    210920-l8q68sgcfm

  • MD5

    0c4e4f1c6a4e98f590e27953fc441b14

  • SHA1

    7846c3a3555acbaf5f4ae33e733d51a4e761474a

  • SHA256

    66c03fe9aa990496db6a1f1d0f332d3252115e03622f37f09c6ce8c0ddbd1a5e

  • SHA512

    5652a5c57b922b809d1579c2da502c536b60514dfd0d789945b96846eb994d17862f1644c058a6cc7654457bf1fb606514c7c8abfc24e933b654a8911f2ba18f

Score
10/10
azorultinfostealersuricatatrojan

Malware Config

Extracted

Family

azorult

C2

http://136.144.41.34/index.php

Targets

    • Target

      ORDER WORKBOOK.exe

    • Size

      1.3MB

    • MD5

      38c3c643e80618c83b80b990ae16abe2

    • SHA1

      ee93f02563f008c2715c26b4f8478410e09babcd

    • SHA256

      ff2f7cc30d0eca889fbe37a6ea28172ac1dc0b2ea3563a622cc7de25a96e07f6

    • SHA512

      26328038bbbb4523fd0dbfa8338a1bb09833a5c70de4240aa29944f4d103d358afe673246b924bb69a1f4134b0e945cf03b40685970e863a7f29d5ed02c24111

    Score
    10/10
    azorultinfostealersuricatatrojan

    • Azorult

      An information stealer that was first discovered in 2016, targeting browsing history and passwords.

      trojaninfostealerazorult

    • suricata: ET MALWARE Win32/AZORult V3.2 Client Checkin M17

      suricata: ET MALWARE Win32/AZORult V3.2 Client Checkin M17

      suricata

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks