azorult

General

Target

3ef65642968377f832f577a3631fac424e24e3c86ead5539d31b0583ddd69de3
Size

1.4MB
Sample

210925-gz6hcaaeh4
MD5

4aa3a8caf20e7c75846bfdd6c425f95f
SHA1

021512a5703a8cf5a28a0b2a95d185d30a7c3e40
SHA256

3ef65642968377f832f577a3631fac424e24e3c86ead5539d31b0583ddd69de3
SHA512

15bfeca05e84aaa12e745d29a7fef7019552c45a5cfef5aca111182ce16ef1c6f5646d49921b58102ac68d4e818031ff6445708d7857f68a7c07e98045f166fa

Score

10^/10

Malware Config

Extracted

Family

raccoon

Botnet

e16d9c3413a8d3bc552d87560e5a14148908608d

Attributes

url4cnc
https://t.me/brikitiki

rc4.plain

Extracted

Family

azorult

C2

http://195.245.112.115/index.php

Extracted

Family

oski

C2

maurizio.ug

Targets

- Target
  
  3ef65642968377f832f577a3631fac424e24e3c86ead5539d31b0583ddd69de3
- Size
  
  1.4MB
- MD5
  
  4aa3a8caf20e7c75846bfdd6c425f95f
- SHA1
  
  021512a5703a8cf5a28a0b2a95d185d30a7c3e40
- SHA256
  
  3ef65642968377f832f577a3631fac424e24e3c86ead5539d31b0583ddd69de3
- SHA512
  
  15bfeca05e84aaa12e745d29a7fef7019552c45a5cfef5aca111182ce16ef1c6f5646d49921b58102ac68d4e818031ff6445708d7857f68a7c07e98045f166fa
Score

10^/10

azorult oski raccoon e16d9c3413a8d3bc552d87560e5a14148908608d discovery infostealer spyware stealer trojan
- Azorult
  An information stealer that was first discovered in 2016, targeting browsing history and passwords.
  trojan infostealer azorult
- Oski
  Oski is an infostealer targeting browser data, crypto wallets.
  infostealer oski
- Raccoon
  Simple but powerful infostealer which was very active in 2019.
  stealer raccoon
- Downloads MZ/PE file
- Executes dropped EXE
- Loads dropped DLL
- Reads user/profile data of local email clients
  Email clients store some user data on disk where infostealers will often target it.
  spyware stealer
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Accesses cryptocurrency files/wallets, possible credential harvesting
  spyware
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Suspicious use of SetThreadContext
behavioral1