Overview

overview

10

Static

static

10

6d896f2f64...76.exe

windows7_x64

10

6d896f2f64...76.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    6d896f2f6450428eda5afc2c1dcf3c76b5a3c0c0705cdf7c6ded486864afce76

  • Size

    152KB

  • Sample

    220219-2an7zsdha8

  • MD5

    da7b10cf0c357c73336f37f7dd32788b

  • SHA1

    18358fef5648382a9522bc5bbb57136b18c56278

  • SHA256

    6d896f2f6450428eda5afc2c1dcf3c76b5a3c0c0705cdf7c6ded486864afce76

  • SHA512

    56c1ac3b8f670dd248034d68584e08287dac978fbc776e0b5e0605008a1138111c814b71baf42856d2e2307807da5a469e1e173379d271fe3099edb194c8b893

Score
10/10
azorultneshtainfostealerpersistencespywarestealertrojan

Malware Config

Extracted

Family

azorult

C2

http://195.245.112.115/index.php

Targets

    • Target

      6d896f2f6450428eda5afc2c1dcf3c76b5a3c0c0705cdf7c6ded486864afce76

    • Size

      152KB

    • MD5

      da7b10cf0c357c73336f37f7dd32788b

    • SHA1

      18358fef5648382a9522bc5bbb57136b18c56278

    • SHA256

      6d896f2f6450428eda5afc2c1dcf3c76b5a3c0c0705cdf7c6ded486864afce76

    • SHA512

      56c1ac3b8f670dd248034d68584e08287dac978fbc776e0b5e0605008a1138111c814b71baf42856d2e2307807da5a469e1e173379d271fe3099edb194c8b893

    Score
    10/10
    azorultneshtainfostealerpersistencespywarestealertrojan

    • Azorult

      An information stealer that was first discovered in 2016, targeting browsing history and passwords.

      trojaninfostealerazorult

    • Modifies system executable filetype association

      persistence

    • Neshta

      Malware from the neshta family is designed to infect itself into other files to spread itself and cause damage.

      persistencespywareneshta

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks