azorult | fb0dff8c7e3049d7038a7e0472c75f24f117f0940a75655bd5f5a871c18e830b | Triage

Sharing

General

Target

fb0dff8c7e3049d7038a7e0472c75f24f117f0940a75655bd5f5a871c18e830b
Size

152KB
Sample

220701-d8et7scdb2
MD5

a230fe4458d454a3bf7479892be0637b
SHA1

61b40f67105898c7a1a777aced797c7c3ab6ee12
SHA256

fb0dff8c7e3049d7038a7e0472c75f24f117f0940a75655bd5f5a871c18e830b
SHA512

d0059135cd0376a303f53f8142e2fee7ea445c7429ba01cb5dcd3b6ebfcdea9c0380d26ff21ccf4aec2fed81460c0457094ff2d66757e8a9e3d354cf017e25a7

Score

10^/10

azorult guloader downloader infostealer trojan

Malware Config

Extracted

Family

guloader

C2

https://drive.google.com/uc?export=download&id=1G9NTARL7o1u0BlE4fQdDrjoWDeOTB5SE

Extracted

Family

azorult

C2

http://195.245.112.115/index.php

Targets

- Target
  
  fb0dff8c7e3049d7038a7e0472c75f24f117f0940a75655bd5f5a871c18e830b
- Size
  
  152KB
- MD5
  
  a230fe4458d454a3bf7479892be0637b
- SHA1
  
  61b40f67105898c7a1a777aced797c7c3ab6ee12
- SHA256
  
  fb0dff8c7e3049d7038a7e0472c75f24f117f0940a75655bd5f5a871c18e830b
- SHA512
  
  d0059135cd0376a303f53f8142e2fee7ea445c7429ba01cb5dcd3b6ebfcdea9c0380d26ff21ccf4aec2fed81460c0457094ff2d66757e8a9e3d354cf017e25a7
Score

10^/10

azorult guloader downloader infostealer trojan
- Azorult
  An information stealer that was first discovered in 2016, targeting browsing history and passwords.
  trojan infostealer azorult
- Guloader,Cloudeye
  A shellcode based downloader first seen in 2020.
  downloader guloader
- Legitimate hosting services abused for malware hosting/C2
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Web Service

Impact

Tasks

static1

behavioral1

azorultguloaderdownloaderinfostealertrojan

behavioral2

azorultguloaderdownloaderinfostealertrojan