Overview

overview

10

Static

static

10

408402d17a...86.exe

windows7_x64

10

408402d17a...86.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    408402d17a78ae194aa3beebd311d4b83a29965deaa7a2d72d17391014abbe86.exe

  • Size

    112KB

  • Sample

    220521-yh2lhagcen

  • MD5

    0f3d47c4b704480efff0f9afde458827

  • SHA1

    86a14e412e135e3fdf80cdba5b64e556b6b86c82

  • SHA256

    408402d17a78ae194aa3beebd311d4b83a29965deaa7a2d72d17391014abbe86

  • SHA512

    aed8dabc92b82871a764bd7aa080bc8be05028dbcc669ce33ec4d29a50bd1ceda254f71bab82c307441713b3af32f8a383b9df20896bcfd9b648b957246c81dd

Score
10/10
azorultcollectiondiscoveryinfostealerspywarestealersuricatatrojan

Malware Config

Extracted

Family

azorult

C2

http://84.38.133.52/aristo/Panel/index.php

Targets

    • Target

      408402d17a78ae194aa3beebd311d4b83a29965deaa7a2d72d17391014abbe86.exe

    • Size

      112KB

    • MD5

      0f3d47c4b704480efff0f9afde458827

    • SHA1

      86a14e412e135e3fdf80cdba5b64e556b6b86c82

    • SHA256

      408402d17a78ae194aa3beebd311d4b83a29965deaa7a2d72d17391014abbe86

    • SHA512

      aed8dabc92b82871a764bd7aa080bc8be05028dbcc669ce33ec4d29a50bd1ceda254f71bab82c307441713b3af32f8a383b9df20896bcfd9b648b957246c81dd

    Score
    10/10
    azorultcollectiondiscoveryinfostealerspywarestealersuricatatrojan

    • Azorult

      An information stealer that was first discovered in 2016, targeting browsing history and passwords.

      trojaninfostealerazorult

    • suricata: ET MALWARE AZORult Variant.4 Checkin M2

      suricata: ET MALWARE AZORult Variant.4 Checkin M2

      suricata

    • suricata: ET MALWARE AZORult v3.2 Server Response M3

      suricata: ET MALWARE AZORult v3.2 Server Response M3

      suricata

    • suricata: ET MALWARE Win32/AZORult V3.2 Client Checkin M13

      suricata: ET MALWARE Win32/AZORult V3.2 Client Checkin M13

      suricata

    • suricata: ET MALWARE Win32/AZORult V3.2 Client Checkin M4

      suricata: ET MALWARE Win32/AZORult V3.2 Client Checkin M4

      suricata

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Loads dropped DLL

    • Reads data files stored by FTP clients

      Tries to access configuration files associated with programs like FileZilla.

      spywarestealer

    • Reads local data of messenger clients

      Infostealers often target stored data of messaging applications, which can include saved credentials and account information.

      spywarestealer

    • Reads user/profile data of local email clients

      Email clients store some user data on disk where infostealers will often target it.

      spywarestealer

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Accesses Microsoft Outlook profiles

      collection

    • Accesses cryptocurrency files/wallets, possible credential harvesting

      spyware

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery
    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

5
T1081

Discovery

Query Registry

3
T1012

System Information Discovery

3
T1082

Lateral Movement

Collection

Data from Local System

5
T1005

Email Collection

1
T1114

Exfiltration

Command and Control

Impact

Tasks