Overview

overview

10

Static

static

9cbcdec6b8...ca.exe

windows7_x64

10

9cbcdec6b8...ca.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    9cbcdec6b8050a81720597c76e29fb7c89fc12dce7eb26a68ab8542235824aca.exe

  • Size

    449KB

  • Sample

    220521-yh1dfagccr

  • MD5

    0df353bc1f264422bdb2ecf1a1ad30b6

  • SHA1

    8e926f65c2a5fc9afea2d49ae04a25845515c37a

  • SHA256

    9cbcdec6b8050a81720597c76e29fb7c89fc12dce7eb26a68ab8542235824aca

  • SHA512

    9c1103d252808264453c018a012c45c07fdbc71cedbc44cfb0620a134106e445084ed28a6feb80e8de46442affc4c32ce28c2807d118b7c73a0687e05444477c

Score
10/10
azorultinfostealersuricatatrojan

Malware Config

Extracted

Family

azorult

C2

http://5gw4d.xyz/PL341/index.php

Targets

    • Target

      9cbcdec6b8050a81720597c76e29fb7c89fc12dce7eb26a68ab8542235824aca.exe

    • Size

      449KB

    • MD5

      0df353bc1f264422bdb2ecf1a1ad30b6

    • SHA1

      8e926f65c2a5fc9afea2d49ae04a25845515c37a

    • SHA256

      9cbcdec6b8050a81720597c76e29fb7c89fc12dce7eb26a68ab8542235824aca

    • SHA512

      9c1103d252808264453c018a012c45c07fdbc71cedbc44cfb0620a134106e445084ed28a6feb80e8de46442affc4c32ce28c2807d118b7c73a0687e05444477c

    Score
    10/10
    azorultinfostealersuricatatrojan

    • Azorult

      An information stealer that was first discovered in 2016, targeting browsing history and passwords.

      trojaninfostealerazorult

    • suricata: ET MALWARE Win32/AZORult V3.3 Client Checkin M15

      suricata: ET MALWARE Win32/AZORult V3.3 Client Checkin M15

      suricata

    • suricata: ET MALWARE Win32/AZORult V3.3 Client Checkin M6

      suricata: ET MALWARE Win32/AZORult V3.3 Client Checkin M6

      suricata

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1
T1053

Persistence

Scheduled Task

1
T1053

Privilege Escalation

Scheduled Task

1
T1053

Defense Evasion

Credential Access

Discovery

Query Registry

1
T1012

System Information Discovery

2
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks