azorult

General

Target

0b7410c41dd49a7a43487fa0e56f5b336951609e67b873d5cdd70632a954b4a8.exe
Size

512KB
Sample

220210-aepwjabhf2
MD5

1fdf9b9ac3b1b74a73f0dfdbdbd99827
SHA1

4fca8630117e276b664de8e75a0c6ae3ed5ad48e
SHA256

0b7410c41dd49a7a43487fa0e56f5b336951609e67b873d5cdd70632a954b4a8
SHA512

53c3d9c915c1777788dd30d2c062d433339f42adb8191fcf883aeb69a244f67f38ecf6cad3bbe9a1fd38b138e7d1847209d116781a5f3c21e5dd724e50daff6d

Score

10^/10

Malware Config

Extracted

Family

azorult

C2

http://195.245.112.115/index.php

Extracted

Family

oski

C2

pretorian.ug

Extracted

Family

raccoon

Botnet

125d9f8ed76e486f6563be097a710bd4cba7f7f2

Attributes

url4cnc
http://5.252.178.180/brikitiki
https://t.me/brikitiki

rc4.plain

Targets

- Target
  
  0b7410c41dd49a7a43487fa0e56f5b336951609e67b873d5cdd70632a954b4a8.exe
- Size
  
  512KB
- MD5
  
  1fdf9b9ac3b1b74a73f0dfdbdbd99827
- SHA1
  
  4fca8630117e276b664de8e75a0c6ae3ed5ad48e
- SHA256
  
  0b7410c41dd49a7a43487fa0e56f5b336951609e67b873d5cdd70632a954b4a8
- SHA512
  
  53c3d9c915c1777788dd30d2c062d433339f42adb8191fcf883aeb69a244f67f38ecf6cad3bbe9a1fd38b138e7d1847209d116781a5f3c21e5dd724e50daff6d
Score

10^/10

azorult oski raccoon 125d9f8ed76e486f6563be097a710bd4cba7f7f2 discovery infostealer spyware stealer trojan upx
- Azorult
  An information stealer that was first discovered in 2016, targeting browsing history and passwords.
  trojan infostealer azorult
- Oski
  Oski is an infostealer targeting browser data, crypto wallets.
  infostealer oski
- Raccoon
  Simple but powerful infostealer which was very active in 2019.
  stealer raccoon
- Suspicious use of NtCreateProcessExOtherParentProcess
- Downloads MZ/PE file
- Executes dropped EXE
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Accesses cryptocurrency files/wallets, possible credential harvesting
  spyware
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

2

T1081

Discovery

Query Registry

4

T1012

System Information Discovery

4

T1082

Lateral Movement

Collection

Data from Local System

2

T1005

Exfiltration

Command and Control

Impact

Tasks

Sharing

General

Malware Config

Extracted

Extracted

Extracted

Targets

Oski

Raccoon

Suspicious use of NtCreateProcessExOtherParentProcess

Downloads MZ/PE file

Executes dropped EXE

UPX packed file

Checks computer location settings

Loads dropped DLL

Reads user/profile data of web browsers

Accesses cryptocurrency files/wallets, possible credential harvesting

Checks installed software on the system

Suspicious use of SetThreadContext

MITRE ATT&CK Matrix ATT&CK v6

Tasks

static1

behavioral1

behavioral2