azorult

Resubmissions

29-09-2021 14:29

210929-rtl7mafcdk 10

29-09-2021 14:25

210929-rre1jafbc3 10

29-09-2021 14:21

210929-rn53jsfbb8 10

Sharing

Copy URL

Twitter E-mail

General

Target

a28f2e84d613b1c2b632352880d530fe
Size

169KB
Sample

210929-rn53jsfbb8
MD5

a28f2e84d613b1c2b632352880d530fe
SHA1

6c036e2f942b68b7903cc9c00d185306661d9a43
SHA256

500b733cbc1ac73598983140ae1b27cb21d06b4e55b5f6d325e5c56b87d8a82f
SHA512

421f68ea65192dc8a9ba0be64f47b308b8785a641e9d775590b3d764071e13a0b149f7052e785e44d3e44c6396a16fcc725f759adb94b6ffafc117fba0000ae6

Score

10^/10

Malware Config

Extracted

Family

azorult

http://37.0.8.36/oxxs/index.php

Targets

- Target
  
  a28f2e84d613b1c2b632352880d530fe
- Size
  
  169KB
- MD5
  
  a28f2e84d613b1c2b632352880d530fe
- SHA1
  
  6c036e2f942b68b7903cc9c00d185306661d9a43
- SHA256
  
  500b733cbc1ac73598983140ae1b27cb21d06b4e55b5f6d325e5c56b87d8a82f
- SHA512
  
  421f68ea65192dc8a9ba0be64f47b308b8785a641e9d775590b3d764071e13a0b149f7052e785e44d3e44c6396a16fcc725f759adb94b6ffafc117fba0000ae6
Score

10^/10

azorult infostealer trojan discovery spyware stealer persistence
- Azorult
  An information stealer that was first discovered in 2016, targeting browsing history and passwords.
  trojan infostealer azorult
- Registers COM server for autorun
  persistence
- Suspicious use of NtCreateProcessExOtherParentProcess
- Deletes itself
- Loads dropped DLL
- Reads data files stored by FTP clients
  Tries to access configuration files associated with programs like FileZilla.
  spyware stealer
- Reads local data of messenger clients
  Infostealers often target stored data of messaging applications, which can include saved credentials and account information.
  spyware stealer
- Reads user/profile data of local email clients
  Email clients store some user data on disk where infostealers will often target it.
  spyware stealer
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Accesses cryptocurrency files/wallets, possible credential harvesting
  spyware
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Drops file in System32 directory
behavioral1 behavioral2 behavioral3 behavioral4 behavioral5 behavioral6 behavioral7 behavioral8

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

T1081

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Exfiltration

Command and Control

Impact

Tasks

Resubmissions

Sharing

General

Malware Config

Extracted

Targets

Registers COM server for autorun

Suspicious use of NtCreateProcessExOtherParentProcess

Deletes itself

Loads dropped DLL

Reads data files stored by FTP clients

Reads local data of messenger clients

Reads user/profile data of local email clients

Reads user/profile data of web browsers

Accesses cryptocurrency files/wallets, possible credential harvesting

Checks installed software on the system

Drops file in System32 directory

MITRE ATT&CK Matrix ATT&CK v6

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8