General

  • Target
    SecuriteInfo.com.Variant.MSILHeracles.38917.23524.20275
  • Size 693KB
  • Sample220602-msghjaafgl
  • SHA256 d9d149954cd130fcab001db9a191bac89c5cebe94744cc8a7ef64b9f1a8a81a8
  • MD5 SHA1 SHA512

Malware Config

Extracted

Family
  • azorult

C2
  • http://84.38.129.36//index.php

Targets

    • Target
      SecuriteInfo.com.Variant.MSILHeracles.38917.23524.20275
    • Size 693KB
    • SHA256 d9d149954cd130fcab001db9a191bac89c5cebe94744cc8a7ef64b9f1a8a81a8
    • MD5 SHA1 SHA512
    • Azorult

      An information stealer that was first discovered in 2016, targeting browsing history and passwords.

    • suricata: ET MALWARE AZORult Variant.4 Checkin M2

      suricata: ET MALWARE AZORult Variant.4 Checkin M2

    • suricata: ET MALWARE Win32/AZORult V3.2 Client Checkin M13

      suricata: ET MALWARE Win32/AZORult V3.2 Client Checkin M13

    • suricata: ET MALWARE Win32/AZORult V3.2 Client Checkin M4

      suricata: ET MALWARE Win32/AZORult V3.2 Client Checkin M4

    • Suspicious use of SetThreadContext

MITRE ATT&CK Matrix

Tasks