azorult

General

Target

9320f896b3bccdd93eafdfef6bfcb75c57a228fa50f3978c44e8e07ac693698a
Size

1.8MB
Sample

220724-2j4c9sbcgr
MD5

e2aaaa8dca87da4b8e76441cdda8a344
SHA1

a7815af1153100a5785506b0b3fb90289d47a0dd
SHA256

9320f896b3bccdd93eafdfef6bfcb75c57a228fa50f3978c44e8e07ac693698a
SHA512

bc5d4b4420200d68d08f90b146675d19fda0ba789df81035f2190c61b9227df87e9e4a24b6f6f8c12485daaf63ccb83167c6c60455a1959212711641a20cedb6

Score

10^/10

Malware Config

Extracted

Family

azorult

C2

http://julaly.ml/tiv202/index.php

Targets

- Target
  
  9320f896b3bccdd93eafdfef6bfcb75c57a228fa50f3978c44e8e07ac693698a
- Size
  
  1.8MB
- MD5
  
  e2aaaa8dca87da4b8e76441cdda8a344
- SHA1
  
  a7815af1153100a5785506b0b3fb90289d47a0dd
- SHA256
  
  9320f896b3bccdd93eafdfef6bfcb75c57a228fa50f3978c44e8e07ac693698a
- SHA512
  
  bc5d4b4420200d68d08f90b146675d19fda0ba789df81035f2190c61b9227df87e9e4a24b6f6f8c12485daaf63ccb83167c6c60455a1959212711641a20cedb6
Score

10^/10

azorult infostealer persistence suricata trojan upx
- Azorult
  An information stealer that was first discovered in 2016, targeting browsing history and passwords.
  trojan infostealer azorult
- suricata: ET MALWARE AZORult Variant.4 Checkin M2
  suricata: ET MALWARE AZORult Variant.4 Checkin M2
  suricata
- suricata: ET MALWARE Win32/AZORult V3.2 Client Checkin M13
  suricata: ET MALWARE Win32/AZORult V3.2 Client Checkin M13
  suricata
- suricata: ET MALWARE Win32/AZORult V3.2 Client Checkin M6
  suricata: ET MALWARE Win32/AZORult V3.2 Client Checkin M6
  suricata
- Executes dropped EXE
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
- Loads dropped DLL
- Adds Run key to start application
  persistence
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Targets

suricata: ET MALWARE AZORult Variant.4 Checkin M2

suricata: ET MALWARE Win32/AZORult V3.2 Client Checkin M13

suricata: ET MALWARE Win32/AZORult V3.2 Client Checkin M6

Executes dropped EXE

UPX packed file

Loads dropped DLL

Adds Run key to start application

Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v6

Tasks

static1

behavioral1

behavioral2