General
-
Target
63cff2624610c0ba77145f4ca69ca649dd063e5da23b6f9534ffc643fe30b203
-
Size
2.1MB
-
Sample
211005-m74avahfd7
-
MD5
d907de96adcb7c400834d974754ece57
-
SHA1
89cf58eb2fb76d42a1283c8068ac36adcc9d66c9
-
SHA256
63cff2624610c0ba77145f4ca69ca649dd063e5da23b6f9534ffc643fe30b203
-
SHA512
02c1fe42f9729539d1181542899399cb779764f178dd0fff005a44e20f50cecd7b3a09e8d36488a192c68f6783973b9b62614e948513dc29df77ca4866b0783e
Static task
static1
Behavioral task
behavioral1
Sample
63cff2624610c0ba77145f4ca69ca649dd063e5da23b6f9534ffc643fe30b203.exe
Resource
win10-en-20210920
Malware Config
Extracted
raccoon
1.8.1
e16d9c3413a8d3bc552d87560e5a14148908608d
-
url4cnc
https://t.me/brikitiki
Extracted
azorult
http://195.245.112.115/index.php
Extracted
oski
milsom.ug
Targets
-
-
Target
63cff2624610c0ba77145f4ca69ca649dd063e5da23b6f9534ffc643fe30b203
-
Size
2.1MB
-
MD5
d907de96adcb7c400834d974754ece57
-
SHA1
89cf58eb2fb76d42a1283c8068ac36adcc9d66c9
-
SHA256
63cff2624610c0ba77145f4ca69ca649dd063e5da23b6f9534ffc643fe30b203
-
SHA512
02c1fe42f9729539d1181542899399cb779764f178dd0fff005a44e20f50cecd7b3a09e8d36488a192c68f6783973b9b62614e948513dc29df77ca4866b0783e
-
Azorult
An information stealer that was first discovered in 2016, targeting browsing history and passwords.
-
Downloads MZ/PE file
-
Executes dropped EXE
-
Loads dropped DLL
-
Accesses cryptocurrency files/wallets, possible credential harvesting
-
Adds Run key to start application
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Suspicious use of SetThreadContext
-