Overview

overview

10

Static

static

10

4ed607dc59...c7.exe

windows7_x64

10

4ed607dc59...c7.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    4ed607dc59589b6af9fbaa3a287d7e9a07d8b175542ab910c863a1a3e0a3c8c7

  • Size

    152KB

  • Sample

    220219-2qbltseah2

  • MD5

    bb56886ff83e5ab9e15d1041b79de9a9

  • SHA1

    4df5f4534af6e7e2d6d12fccd1739a824575185e

  • SHA256

    4ed607dc59589b6af9fbaa3a287d7e9a07d8b175542ab910c863a1a3e0a3c8c7

  • SHA512

    7c3f38ba63bb101e24a5c1ac64991936a96b51cec504c87377ee239be951c3ef3299da1e9622726db6603d062ff46dfb26062b20bfe12f830067f2789d6170f6

Score
10/10
azorultneshtainfostealerpersistencespywarestealertrojan

Malware Config

Extracted

Family

azorult

C2

http://195.245.112.115/index.php

Targets

    • Target

      4ed607dc59589b6af9fbaa3a287d7e9a07d8b175542ab910c863a1a3e0a3c8c7

    • Size

      152KB

    • MD5

      bb56886ff83e5ab9e15d1041b79de9a9

    • SHA1

      4df5f4534af6e7e2d6d12fccd1739a824575185e

    • SHA256

      4ed607dc59589b6af9fbaa3a287d7e9a07d8b175542ab910c863a1a3e0a3c8c7

    • SHA512

      7c3f38ba63bb101e24a5c1ac64991936a96b51cec504c87377ee239be951c3ef3299da1e9622726db6603d062ff46dfb26062b20bfe12f830067f2789d6170f6

    Score
    10/10
    azorultneshtainfostealerpersistencespywarestealertrojan

    • Azorult

      An information stealer that was first discovered in 2016, targeting browsing history and passwords.

      trojaninfostealerazorult

    • Modifies system executable filetype association

      persistence

    • Neshta

      Malware from the neshta family is designed to infect itself into other files to spread itself and cause damage.

      persistencespywareneshta

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks