General
-
Target
Halkbank_Ekstre_20191102_073809_405251-PDF.exe
-
Size
26KB
-
Sample
211203-lwmy2sgadq
-
MD5
07fec7939865e6cb719f2b2fbe48091d
-
SHA1
2978b88682f86b3a76aaad68add2b8e40d3972fd
-
SHA256
7ea33c91dc1a98b9ab5229455e951d38f4d4563130f87d3fa290b9b01b2337dd
-
SHA512
c0cb566430c6e7d37984de037aa862057feb255cc7e2227381e980f6e745589e52222b7c486ac20cbd920ea37d5206b9afaa84dfb2fe3b7ef2957895ffd0034f
Static task
static1
Behavioral task
behavioral1
Sample
Halkbank_Ekstre_20191102_073809_405251-PDF.exe
Resource
win7-en-20211014
Behavioral task
behavioral2
Sample
Halkbank_Ekstre_20191102_073809_405251-PDF.exe
Resource
win10-en-20211104
Malware Config
Extracted
azorult
http://sparrowxx.xyz/az2/index.php
Targets
-
-
Target
Halkbank_Ekstre_20191102_073809_405251-PDF.exe
-
Size
26KB
-
MD5
07fec7939865e6cb719f2b2fbe48091d
-
SHA1
2978b88682f86b3a76aaad68add2b8e40d3972fd
-
SHA256
7ea33c91dc1a98b9ab5229455e951d38f4d4563130f87d3fa290b9b01b2337dd
-
SHA512
c0cb566430c6e7d37984de037aa862057feb255cc7e2227381e980f6e745589e52222b7c486ac20cbd920ea37d5206b9afaa84dfb2fe3b7ef2957895ffd0034f
-
Azorult
An information stealer that was first discovered in 2016, targeting browsing history and passwords.
-
suricata: ET MALWARE AZORult v3.3 Server Response M3
suricata: ET MALWARE AZORult v3.3 Server Response M3
-
suricata: ET MALWARE Observed Malicious SSL Cert (BitRAT CnC)
suricata: ET MALWARE Observed Malicious SSL Cert (BitRAT CnC)
-
suricata: ET MALWARE Win32/AZORult V3.3 Client Checkin M18
suricata: ET MALWARE Win32/AZORult V3.3 Client Checkin M18
-
suricata: ET MALWARE Win32/AZORult V3.3 Client Checkin M6
suricata: ET MALWARE Win32/AZORult V3.3 Client Checkin M6
-
ACProtect 1.3x - 1.4x DLL software
Detects file using ACProtect software.
-
Executes dropped EXE
-
Deletes itself
-
Loads dropped DLL
-
Accesses Microsoft Outlook accounts
-
Accesses Microsoft Outlook profiles
-
Accesses cryptocurrency files/wallets, possible credential harvesting
-
Adds Run key to start application
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Suspicious use of NtSetInformationThreadHideFromDebugger
-
Suspicious use of SetThreadContext
-