azorult | 3bc13b6c499c632b94e2b1fd7d83d4adaf96d3f147b8e0ab302d74bcda9a82b1

Analysis

Target

3bc13b6c499c632b94e2b1fd7d83d4adaf96d3f147b8e0ab302d74bcda9a82b1.exe
Size

264KB
MD5

6bf4098d9eeb743ffe314362b0d7b52d
SHA1

cf5bab29b03e6419d57ad2f55a973757182aa236
SHA256

3bc13b6c499c632b94e2b1fd7d83d4adaf96d3f147b8e0ab302d74bcda9a82b1
SHA512

36d783f3287ed58b7c0d594dcd614c3651ae39a1b1801e075de6e931184f2f805ad6772a9fd4fe6cc063d4584a0ab68f7aa348fd02e367e71b5eeab4a74b374e

Score

10^/10

Family

azorult

http://195.245.112.115/index.php

Azorult
An information stealer that was first discovered in 2016, targeting browsing history and passwords.
trojan infostealer azorult
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

5100 2452 WerFault.exe 3bc13b6c499c632b94e2b1fd7d83d4adaf96d3f147b8e0ab302d74bcda9a82b1.exe

pid	pid_target	process	target process
5100	2452	WerFault.exe	3bc13b6c499c632b94e2b1fd7d83d4adaf96d3f147b8e0ab302d74bcda9a82b1.exe

C:\Users\Admin\AppData\Local\Temp\3bc13b6c499c632b94e2b1fd7d83d4adaf96d3f147b8e0ab302d74bcda9a82b1.exe
"C:\Users\Admin\AppData\Local\Temp\3bc13b6c499c632b94e2b1fd7d83d4adaf96d3f147b8e0ab302d74bcda9a82b1.exe"
1⤵
PID:2452

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2452 -s 1448
2⤵
- Program crash
PID:5100

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 2452 -ip 2452
1⤵
PID:2172

memory/2452-130-0x000000000334E000-0x000000000335F000-memory.dmp

Filesize
68KB

Download
memory/2452-131-0x000000000334E000-0x000000000335F000-memory.dmp

Filesize
68KB

Download
memory/2452-132-0x0000000000400000-0x0000000003041000-memory.dmp

Filesize
44.3MB

Download
memory/2452-133-0x0000000000400000-0x0000000003041000-memory.dmp

Filesize
44.3MB

Download
memory/2452-134-0x0000000000400000-0x0000000003041000-memory.dmp

Filesize
44.3MB

Download