azorult | f4f320fd3ca17e544dc33f90d02a769ecba5dec0f05cc08b9981dfc5a81900f8

Analysis

Target

f4f320fd3ca17e544dc33f90d02a769ecba5dec0f05cc08b9981dfc5a81900f8.exe
Size

300KB
MD5

6bf580ccfa8cdef620ba37082e5f7d66
SHA1

d0e590d8615e640cc563a5d6294df8278ae3f2e5
SHA256

f4f320fd3ca17e544dc33f90d02a769ecba5dec0f05cc08b9981dfc5a81900f8
SHA512

f6023345ca884ae4200748a17dc6f45e9001a2de5e09c278298968fd091c91f27c1ee6cfcc11b3934ed02b430a5e34d921aa4ff171db2e86656f0a0a2b49ca5e

Score

10^/10

Family

azorult

http://2.56.59.31/purelogs/index.php

Azorult
An information stealer that was first discovered in 2016, targeting browsing history and passwords.
trojan infostealer azorult
suricata: ET MALWARE Win32/AZORult V3.3 Client Checkin M13
suricata: ET MALWARE Win32/AZORult V3.3 Client Checkin M13
suricata
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

2716 2556 WerFault.exe f4f320fd3ca17e544dc33f90d02a769ecba5dec0f05cc08b9981dfc5a81900f8.exe

pid	pid_target	process	target process
2716	2556	WerFault.exe	f4f320fd3ca17e544dc33f90d02a769ecba5dec0f05cc08b9981dfc5a81900f8.exe

C:\Users\Admin\AppData\Local\Temp\f4f320fd3ca17e544dc33f90d02a769ecba5dec0f05cc08b9981dfc5a81900f8.exe
"C:\Users\Admin\AppData\Local\Temp\f4f320fd3ca17e544dc33f90d02a769ecba5dec0f05cc08b9981dfc5a81900f8.exe"
1⤵
PID:2556
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2556 -s 1248
  2⤵
  - Program crash
  PID:2716

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 2556 -ip 2556
1⤵
PID:1724

memory/2556-130-0x00000000004CF000-0x00000000004E1000-memory.dmp

Filesize
72KB

Download
memory/2556-131-0x00000000021B0000-0x00000000021CD000-memory.dmp

Filesize
116KB

Download
memory/2556-132-0x0000000000400000-0x0000000000476000-memory.dmp

Filesize
472KB

Download