azorult | c88a5164ed8096987fec3ad792484f70034f5f1da0d22c5c9d32520a9c7c8ac2

Analysis

Target

c88a5164ed8096987fec3ad792484f70034f5f1da0d22c5c9d32520a9c7c8ac2.exe
Size

230KB
MD5

5adcf50e6c42524cac8c38049bf14eec
SHA1

78aa0e7a40d22a59b437c5a5609609af7d54ae13
SHA256

c88a5164ed8096987fec3ad792484f70034f5f1da0d22c5c9d32520a9c7c8ac2
SHA512

8bca81a231f89ecb4ecf3a2bab4fd4c69b5c7f9cceee96984ed923c443d550d9cc37249f02d83dec47aeac946840d15e6b3310aae40bb878c95aeae05f0b7135

Score

10^/10

Family

azorult

http://khaliddib398.xyz/index.php

Azorult
An information stealer that was first discovered in 2016, targeting browsing history and passwords.
trojan infostealer azorult
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

3952 4144 WerFault.exe c88a5164ed8096987fec3ad792484f70034f5f1da0d22c5c9d32520a9c7c8ac2.exe

pid	pid_target	process	target process
3952	4144	WerFault.exe	c88a5164ed8096987fec3ad792484f70034f5f1da0d22c5c9d32520a9c7c8ac2.exe

C:\Users\Admin\AppData\Local\Temp\c88a5164ed8096987fec3ad792484f70034f5f1da0d22c5c9d32520a9c7c8ac2.exe
"C:\Users\Admin\AppData\Local\Temp\c88a5164ed8096987fec3ad792484f70034f5f1da0d22c5c9d32520a9c7c8ac2.exe"
1⤵
PID:4144

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4144 -s 1384
2⤵
- Program crash
PID:3952

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 4144 -ip 4144
1⤵
PID:2024

memory/4144-130-0x0000000000DF7000-0x0000000000E08000-memory.dmp

Filesize
68KB

Download
memory/4144-131-0x0000000000C90000-0x0000000000CAD000-memory.dmp

Filesize
116KB

Download
memory/4144-132-0x0000000000400000-0x0000000000B7F000-memory.dmp

Filesize
7.5MB

Download
memory/4144-133-0x0000000000DF7000-0x0000000000E08000-memory.dmp

Filesize
68KB

Download
memory/4144-134-0x0000000000400000-0x0000000000B7F000-memory.dmp

Filesize
7.5MB

Download