azorult

General

Target

005e04a19875e8e122c919a7e8ef88b2d15efff1eadb8a30c4096e9194d52494
Size

1015KB
Sample

220521-pp92safge5
MD5

e9c9f0069ccb2268778de10e993aaeea
SHA1

42f68d5e83f5c9af998d404bdecd77e9f3e8f93b
SHA256

005e04a19875e8e122c919a7e8ef88b2d15efff1eadb8a30c4096e9194d52494
SHA512

c0b254a02253b2901669611523778b31fb29101bbb45c73ff8fcb7b3e43797a824f0f9854a63bb16c3cd420d41631d89f76b8e5f6dd95c29de567ac0eabda079

Score

10^/10

Malware Config

Extracted

Path

C:\Users\Admin\AppData\Local\Temp\AEF946DCB4\Log.txt

Family

masslogger

Ransom Note

################################################################# MassLogger v1.3.5.0 ################################################################# ### Logger Details ### User Name: Admin IP: 154.61.71.50 Location: United States OS: Microsoft Windows 7 Ultimate 64bit CPU: Intel Core Processor (Broadwell) GPU: Standard VGA Graphics Adapter AV: NA Screen Resolution: 1280x720 Current Time: 5/21/2022 3:11:25 PM MassLogger Started: 5/21/2022 3:11:05 PM Interval: 2 hour MassLogger Process: C:\Users\Admin\AppData\Local\Temp\DATASHEET.exe MassLogger Melt: false MassLogger Exit after delivery: true As Administrator: True Processes:

Extracted

Credentials

Protocol: smtp
Host:
mail.mkontakt.az
Port:
587
Username:
[email protected]
Password:
Onyeoba111

Extracted

Path

C:\Users\Admin\AppData\Local\Temp\F95B724EDE\Log.txt

Family

masslogger

Ransom Note

################################################################# MassLogger v1.3.5.0 ################################################################# ### Logger Details ### User Name: Admin IP: 154.61.71.50 Location: United States OS: Microsoft Windows 10 Pro64bit CPU: Intel Core Processor (Broadwell) GPU: Microsoft Basic Display Adapter AV: NA Screen Resolution: 1280x720 Current Time: 5/21/2022 3:11:40 PM MassLogger Started: 5/21/2022 3:11:36 PM Interval: 2 hour MassLogger Process: C:\Users\Admin\AppData\Local\Temp\DATASHEET.exe MassLogger Melt: false MassLogger Exit after delivery: true As Administrator: True Processes:

Extracted

Family

azorult

C2

http://217.160.254.33/index.php

Targets

- Target
  
  DATASHEET.exe
- Size
  
  899KB
- MD5
  
  226ccf305c0971c6634d956809ee618f
- SHA1
  
  55615741a7d8f84f7edaaf0c5bc851944532f98d
- SHA256
  
  4f7ce008febd9fe224c7a7cec7d8abf8c0db3611fd14d8aca135041d21d2b45c
- SHA512
  
  2e0a60a33409a36cc3703fefcaa64f3c7907e53736bc549c5c7f3c93e99d0aba1e4fcbbaa82fe301724f7f93e47fc5f12957452baee9829966193a568d22a80c
Score

10^/10

masslogger collection ransomware spyware stealer
- MassLogger
  Masslogger is a .NET stealer targeting passwords from browsers, email and cryptocurrency clients.
  stealer spyware masslogger
- MassLogger Main Payload
- MassLogger log file
  Detects a log file produced by MassLogger.
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Accesses Microsoft Outlook profiles
  collection
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- Suspicious use of SetThreadContext
behavioral1 behavioral2
- Target
  
  PRODUCT LIST.exe
- Size
  
  294KB
- MD5
  
  a42e195a8a3de45dc2bc88e33af006a4
- SHA1
  
  1ce81ed627893bb2cb4aa83b008dcd10c9203dae
- SHA256
  
  655455e4c04c7fd6e624b752797305264093264c08b0ab45ebfceee5f7abbc66
- SHA512
  
  2a08c7e3110e080d2377e7e25f7cc3f1ff936ceb5e59f5f763955578b68cafe10b8d260a6b3147d0bd6d127774a298181bca8ad6256f40a42318df31756de90c
Score

10^/10

azorult infostealer trojan
- Azorult
  An information stealer that was first discovered in 2016, targeting browsing history and passwords.
  trojan infostealer azorult
- Suspicious use of SetThreadContext
behavioral3 behavioral4

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

1

T1081

Discovery

Query Registry

1

T1012

System Information Discovery

1

T1082

Lateral Movement

Collection

Data from Local System

Email Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Extracted

Extracted

Extracted

Targets

MassLogger

MassLogger Main Payload

MassLogger log file

Checks computer location settings

Reads user/profile data of web browsers

Accesses Microsoft Outlook profiles

Looks up external IP address via web service

Suspicious use of SetThreadContext

Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v6

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4