azorult | fbad089f1244959e6c4178dc7df3914ce2ecfa4a4d8a9273141a220d44972646

Analysis

Target

fbad089f1244959e6c4178dc7df3914ce2ecfa4a4d8a9273141a220d44972646.exe
Size

416KB
MD5

562a061909e2615ded02012723dce00c
SHA1

3e3432cf06fe8e35da97e4dd2f40b1d250354b40
SHA256

fbad089f1244959e6c4178dc7df3914ce2ecfa4a4d8a9273141a220d44972646
SHA512

95e610c69e853ea8f69290240c9842485360745468cd6f848df2b01b3461e145ec6c44a23161b96c361606da7d1042cacdcf3ec24e5e656c32be4ff83c72b077

Score

10^/10

Family

azorult

http://klyaksa.xyz/index.php

Azorult
An information stealer that was first discovered in 2016, targeting browsing history and passwords.
trojan infostealer azorult
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

988 2912 WerFault.exe fbad089f1244959e6c4178dc7df3914ce2ecfa4a4d8a9273141a220d44972646.exe

pid	pid_target	process	target process
988	2912	WerFault.exe	fbad089f1244959e6c4178dc7df3914ce2ecfa4a4d8a9273141a220d44972646.exe

C:\Users\Admin\AppData\Local\Temp\fbad089f1244959e6c4178dc7df3914ce2ecfa4a4d8a9273141a220d44972646.exe
"C:\Users\Admin\AppData\Local\Temp\fbad089f1244959e6c4178dc7df3914ce2ecfa4a4d8a9273141a220d44972646.exe"
1⤵
PID:2912

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2912 -s 1176
2⤵
- Program crash
PID:988

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 428 -p 2912 -ip 2912
1⤵
PID:824

memory/2912-130-0x00000000005E5000-0x00000000005F6000-memory.dmp

Filesize
68KB

Download
memory/2912-131-0x00000000005E5000-0x00000000005F6000-memory.dmp

Filesize
68KB

Download
memory/2912-132-0x0000000000400000-0x00000000004EB000-memory.dmp

Filesize
940KB

Download
memory/2912-133-0x00000000005E5000-0x00000000005F6000-memory.dmp

Filesize
68KB

Download
memory/2912-134-0x0000000000400000-0x00000000004EB000-memory.dmp

Filesize
940KB

Download