azorult

General

Target

9466caa2cf60fdc7ed95a3eb5e5165b1527ca9352195caa355c58099e519e616.exe
Size

6.9MB
Sample

220521-yh1dfagccp
MD5

3ba388cdf2e1ee661d5339bc1c7e0ef6
SHA1

516f99e2c29836b8092a6a33ad90dfec3c528879
SHA256

9466caa2cf60fdc7ed95a3eb5e5165b1527ca9352195caa355c58099e519e616
SHA512

ffb3836e3cdd20811e4ba9dbd3be74eedf3ec3eec95e0f2683b2df2a6230affba03d2af7ad1efac82dbf6dd09db8fd2b8b13a6fc84db6e17111b31ce43ca63e2

Score

10^/10

Malware Config

Extracted

Family

azorult

C2

http://joker9999y.temp.swtest.ru/index.php

Targets

- Target
  
  9466caa2cf60fdc7ed95a3eb5e5165b1527ca9352195caa355c58099e519e616.exe
- Size
  
  6.9MB
- MD5
  
  3ba388cdf2e1ee661d5339bc1c7e0ef6
- SHA1
  
  516f99e2c29836b8092a6a33ad90dfec3c528879
- SHA256
  
  9466caa2cf60fdc7ed95a3eb5e5165b1527ca9352195caa355c58099e519e616
- SHA512
  
  ffb3836e3cdd20811e4ba9dbd3be74eedf3ec3eec95e0f2683b2df2a6230affba03d2af7ad1efac82dbf6dd09db8fd2b8b13a6fc84db6e17111b31ce43ca63e2
Score

10^/10

azorult collection discovery infostealer spyware stealer suricata trojan evasion upx
- Azorult
  An information stealer that was first discovered in 2016, targeting browsing history and passwords.
  trojan infostealer azorult
- suricata: ET MALWARE AZORult v3.3 Server Response M1
  suricata: ET MALWARE AZORult v3.3 Server Response M1
  suricata
- suricata: ET MALWARE Win32/AZORult V3.3 Client Checkin M15
  suricata: ET MALWARE Win32/AZORult V3.3 Client Checkin M15
  suricata
- suricata: ET MALWARE Win32/AZORult V3.3 Client Checkin M4
  suricata: ET MALWARE Win32/AZORult V3.3 Client Checkin M4
  suricata
- ACProtect 1.3x - 1.4x DLL software
  Detects file using ACProtect software.
- Executes dropped EXE
- Sets file to hidden
  Modifies file attributes to stop it showing in Explorer etc.
  evasion
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Loads dropped DLL
- Reads data files stored by FTP clients
  Tries to access configuration files associated with programs like FileZilla.
  spyware stealer
- Reads local data of messenger clients
  Infostealers often target stored data of messaging applications, which can include saved credentials and account information.
  spyware stealer
- Reads user/profile data of local email clients
  Email clients store some user data on disk where infostealers will often target it.
  spyware stealer
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Accesses Microsoft Outlook profiles
  collection
- Accesses cryptocurrency files/wallets, possible credential harvesting
  spyware
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- AutoIT Executable
  AutoIT scripts compiled to PE executables.
- Drops file in System32 directory
- Suspicious use of NtSetInformationThreadHideFromDebugger
behavioral1 behavioral2