General
-
Target
0f26358fd91d83052eca6eade733e5ea
-
Size
1.2MB
-
Sample
210923-gtn14sehf7
-
MD5
0f26358fd91d83052eca6eade733e5ea
-
SHA1
499a644a9c7837735c7d91d3643c67a05fee9255
-
SHA256
2d7fcb87c1ac2786c319720a857328d19e7ac523396992b445fec60de47919df
-
SHA512
38cab68eea27bf7c76e2b23c570d4499c08850b10ce01bac5756416024cf89fb4c873cb6b942a0026666c570421a890e0f1dcacc07c0e93738e15ef18322b8aa
Static task
static1
Behavioral task
behavioral1
Sample
0f26358fd91d83052eca6eade733e5ea.exe
Resource
win7-en-20210920
Malware Config
Extracted
azorult
http://195.245.112.115/index.php
Extracted
oski
maurizio.ug
Targets
-
-
Target
0f26358fd91d83052eca6eade733e5ea
-
Size
1.2MB
-
MD5
0f26358fd91d83052eca6eade733e5ea
-
SHA1
499a644a9c7837735c7d91d3643c67a05fee9255
-
SHA256
2d7fcb87c1ac2786c319720a857328d19e7ac523396992b445fec60de47919df
-
SHA512
38cab68eea27bf7c76e2b23c570d4499c08850b10ce01bac5756416024cf89fb4c873cb6b942a0026666c570421a890e0f1dcacc07c0e93738e15ef18322b8aa
-
Azorult
An information stealer that was first discovered in 2016, targeting browsing history and passwords.
-
Downloads MZ/PE file
-
Executes dropped EXE
-
Loads dropped DLL
-
Accesses cryptocurrency files/wallets, possible credential harvesting
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Suspicious use of SetThreadContext
-