Overview

overview

10

Static

static

a28f2e84d6...fe.exe

windows11_x64

10

a28f2e84d6...fe.exe

windows10_x64

10

Resubmissions

29/09/2021, 14:29

210929-rtl7mafcdk10

29/09/2021, 14:25

210929-rre1jafbc310

29/09/2021, 14:21

210929-rn53jsfbb810

Sharing

Copy URL Twitter E-mail

General

  • Target
    a28f2e84d613b1c2b632352880d530fe
  • Size 169KB
  • Sample210929-rre1jafbc3
  • SHA256 500b733cbc1ac73598983140ae1b27cb21d06b4e55b5f6d325e5c56b87d8a82f
  • MD5 SHA1 SHA512
Score
10/10
azorultinfostealerpersistencetrojan

Malware Config

Extracted

Family

  • azorult

C2

  • http://37.0.8.36/oxxs/index.php

Targets

    • Target
      a28f2e84d613b1c2b632352880d530fe
    • Size 169KB
    • SHA256 500b733cbc1ac73598983140ae1b27cb21d06b4e55b5f6d325e5c56b87d8a82f
    • MD5 SHA1 SHA512
    Score
    10/10
    azorultinfostealerpersistencetrojan

    • Azorult

      An information stealer that was first discovered in 2016, targeting browsing history and passwords.

      trojaninfostealerazorult

    • Registers COM server for autorun

      persistence

    • Suspicious use of NtCreateProcessExOtherParentProcess

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks