Overview

overview

10

Static

static

947830b49d...b5.exe

windows7-x64

10

947830b49d...b5.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    947830b49d52f4a9177007d4a49de641243ab63d1d1ffb7b5e12db3cbe5748b5

  • Size

    484KB

  • Sample

    220725-fz1resgdgk

  • MD5

    45897f1ba88b9686bc982c8e82d3cd9a

  • SHA1

    2f4cfcf65d1156d41c356f855e68add187b77ef1

  • SHA256

    947830b49d52f4a9177007d4a49de641243ab63d1d1ffb7b5e12db3cbe5748b5

  • SHA512

    e508d87a8c81138bf491aa4ef2913a469ff8a0e7ffd7ce3736d77ba834ae903695fe2fd8a7190f677404c3c495726ce2a429de9496abb0ba490ebf8921315159

Score
10/10
azorultagilenetinfostealersuricatatrojan

Malware Config

Extracted

Family

azorult

C2

https://techxim.com/wp-includes/admin/32/index.php

Targets

    • Target

      947830b49d52f4a9177007d4a49de641243ab63d1d1ffb7b5e12db3cbe5748b5

    • Size

      484KB

    • MD5

      45897f1ba88b9686bc982c8e82d3cd9a

    • SHA1

      2f4cfcf65d1156d41c356f855e68add187b77ef1

    • SHA256

      947830b49d52f4a9177007d4a49de641243ab63d1d1ffb7b5e12db3cbe5748b5

    • SHA512

      e508d87a8c81138bf491aa4ef2913a469ff8a0e7ffd7ce3736d77ba834ae903695fe2fd8a7190f677404c3c495726ce2a429de9496abb0ba490ebf8921315159

    Score
    10/10
    azorultagilenetinfostealersuricatatrojan

    • Azorult

      An information stealer that was first discovered in 2016, targeting browsing history and passwords.

      trojaninfostealerazorult

    • suricata: ET MALWARE Observed Malicious SSL Cert (AZORult CnC Server) in SNI 2019-09-27

      suricata: ET MALWARE Observed Malicious SSL Cert (AZORult CnC Server) in SNI 2019-09-27

      suricata

    • suricata: ET MALWARE Win32/AZORult V3.2 Client Checkin M15

      suricata: ET MALWARE Win32/AZORult V3.2 Client Checkin M15

      suricata

    • suricata: ET MALWARE Win32/AZORult V3.2 Client Checkin M5

      suricata: ET MALWARE Win32/AZORult V3.2 Client Checkin M5

      suricata

    • Obfuscated with Agile.Net obfuscator

      Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.

      agilenet

    • Uses the VBS compiler for execution

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scripting

1
T1064

Persistence

Privilege Escalation

Defense Evasion

Scripting

1
T1064

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks