General

  • Target

    55f4abaabd26f831f7896f08ed1dbc42a5500999762479e49559f1ff4f1dac37

  • Size

    939KB

  • Sample

    220725-g3pc8saca9

  • MD5

    27fb0946eb509b5bdc6fb0de25cd0156

  • SHA1

    361c116bd5f7109aa30413a5810889d47d12e0e3

  • SHA256

    55f4abaabd26f831f7896f08ed1dbc42a5500999762479e49559f1ff4f1dac37

  • SHA512

    1861ddb47c8bdfd83b73ca3ffddaf1c24719b670b34beb6c2fece8c514e19ec85455f09876fbae166821a831bb4ef645b274dfd46b511d2b65728dbdaf3d0f38

Malware Config

Extracted

Family

azorult

C2

http://jatkit.ml/A-c1/index.php

Targets

    • Target

      55f4abaabd26f831f7896f08ed1dbc42a5500999762479e49559f1ff4f1dac37

    • Size

      939KB

    • MD5

      27fb0946eb509b5bdc6fb0de25cd0156

    • SHA1

      361c116bd5f7109aa30413a5810889d47d12e0e3

    • SHA256

      55f4abaabd26f831f7896f08ed1dbc42a5500999762479e49559f1ff4f1dac37

    • SHA512

      1861ddb47c8bdfd83b73ca3ffddaf1c24719b670b34beb6c2fece8c514e19ec85455f09876fbae166821a831bb4ef645b274dfd46b511d2b65728dbdaf3d0f38

    • Azorult

      An information stealer that was first discovered in 2016, targeting browsing history and passwords.

    • Adds Run key to start application

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v6

Tasks