azorult

General

Target

INQUIRY 567876.exe
Size

557KB
Sample

211025-yktnnshdhp
MD5

4608e1138db21716c5f14ce2a3352766
SHA1

1ce097d6dd2d24df20a5d223099eec87bedb7732
SHA256

a6ffce1ca89f9c59a8255ffacdd2ec1d58b9c14808c76b5cbca0f0696499dd23
SHA512

5c71521222c14ac6e76041e5d63b545612248df9ab0d640b9a42ee922c5caac4bf7c115f347f38cade1b94445f769250ec6e02440d473b9fa3563d6f8143c19c

Score

10^/10

Malware Config

Extracted

Family

azorult

C2

http://212.192.241.149/index.php

Targets

- Target
  
  INQUIRY 567876.exe
- Size
  
  557KB
- MD5
  
  4608e1138db21716c5f14ce2a3352766
- SHA1
  
  1ce097d6dd2d24df20a5d223099eec87bedb7732
- SHA256
  
  a6ffce1ca89f9c59a8255ffacdd2ec1d58b9c14808c76b5cbca0f0696499dd23
- SHA512
  
  5c71521222c14ac6e76041e5d63b545612248df9ab0d640b9a42ee922c5caac4bf7c115f347f38cade1b94445f769250ec6e02440d473b9fa3563d6f8143c19c
Score

10^/10

azorult collection discovery infostealer spyware stealer suricata trojan
- Azorult
  An information stealer that was first discovered in 2016, targeting browsing history and passwords.
  trojan infostealer azorult
- suricata: ET MALWARE AZORult Variant.4 Checkin M2
  suricata: ET MALWARE AZORult Variant.4 Checkin M2
  suricata
- suricata: ET MALWARE AZORult v3.2 Server Response M3
  suricata: ET MALWARE AZORult v3.2 Server Response M3
  suricata
- suricata: ET MALWARE Win32/AZORult V3.2 Client Checkin M16
  suricata: ET MALWARE Win32/AZORult V3.2 Client Checkin M16
  suricata
- suricata: ET MALWARE Win32/AZORult V3.2 Client Checkin M6
  suricata: ET MALWARE Win32/AZORult V3.2 Client Checkin M6
  suricata
- Loads dropped DLL
- Reads data files stored by FTP clients
  Tries to access configuration files associated with programs like FileZilla.
  spyware stealer
- Reads local data of messenger clients
  Infostealers often target stored data of messaging applications, which can include saved credentials and account information.
  spyware stealer
- Reads user/profile data of local email clients
  Email clients store some user data on disk where infostealers will often target it.
  spyware stealer
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Accesses Microsoft Outlook profiles
  collection
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Suspicious use of SetThreadContext
behavioral1 behavioral2