Overview

overview

10

Static

static

10

d2a6e50d2d...e3.exe

windows7_x64

10

d2a6e50d2d...e3.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    d2a6e50d2d260dc81c139a7e562defd7fe4390c535190613b061711865eb3ce3

  • Size

    152KB

  • Sample

    220219-z1ltfadca7

  • MD5

    3a9815dc4807dd29c7603a4d9d6c8753

  • SHA1

    500a10ff58c76de1b6cb9e320b9120e1c875b139

  • SHA256

    d2a6e50d2d260dc81c139a7e562defd7fe4390c535190613b061711865eb3ce3

  • SHA512

    ef1e5b2ec809490844a59bd83fbf35f000c9f486c75a14ec8ae9959c5dab17f7704efbd16eff5b8f9279eaa1f0a91369d864e527834fb6bbc5be41cd7af25b29

Score
10/10
azorultneshtainfostealerpersistencespywarestealertrojan

Malware Config

Extracted

Family

azorult

C2

http://195.245.112.115/index.php

Targets

    • Target

      d2a6e50d2d260dc81c139a7e562defd7fe4390c535190613b061711865eb3ce3

    • Size

      152KB

    • MD5

      3a9815dc4807dd29c7603a4d9d6c8753

    • SHA1

      500a10ff58c76de1b6cb9e320b9120e1c875b139

    • SHA256

      d2a6e50d2d260dc81c139a7e562defd7fe4390c535190613b061711865eb3ce3

    • SHA512

      ef1e5b2ec809490844a59bd83fbf35f000c9f486c75a14ec8ae9959c5dab17f7704efbd16eff5b8f9279eaa1f0a91369d864e527834fb6bbc5be41cd7af25b29

    Score
    10/10
    azorultneshtainfostealerpersistencespywaretrojanstealer

    • Azorult

      An information stealer that was first discovered in 2016, targeting browsing history and passwords.

      trojaninfostealerazorult

    • Modifies system executable filetype association

      persistence

    • Neshta

      Malware from the neshta family is designed to infect itself into other files to spread itself and cause damage.

      persistencespywareneshta

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks