General

  • Target

    6191f6dcd5db9cbac5d5149707dc764bab339ad7d3b2037a195618cefb4c3a8f

  • Size

    965KB

  • Sample

    220730-zj88eafec5

  • MD5

    e8a43ed0166329db4f562d7708be7f9b

  • SHA1

    c9c88f8e3fba5fa18fedd4b8b8eb80d4f762ea9c

  • SHA256

    6191f6dcd5db9cbac5d5149707dc764bab339ad7d3b2037a195618cefb4c3a8f

  • SHA512

    70806cf602a6487911e91a9ea92e31b65bcfe4eea10873b90682a65aa90874fb9de65b8f8fdbd3d6546325c618bde0b44be60e2ac5d67c32d5c211959832b5da

Malware Config

Extracted

Family

azorult

C2

http://104.233.105.159/0/van/index.php

Targets

    • Target

      6191f6dcd5db9cbac5d5149707dc764bab339ad7d3b2037a195618cefb4c3a8f

    • Size

      965KB

    • MD5

      e8a43ed0166329db4f562d7708be7f9b

    • SHA1

      c9c88f8e3fba5fa18fedd4b8b8eb80d4f762ea9c

    • SHA256

      6191f6dcd5db9cbac5d5149707dc764bab339ad7d3b2037a195618cefb4c3a8f

    • SHA512

      70806cf602a6487911e91a9ea92e31b65bcfe4eea10873b90682a65aa90874fb9de65b8f8fdbd3d6546325c618bde0b44be60e2ac5d67c32d5c211959832b5da

    • Azorult

      An information stealer that was first discovered in 2016, targeting browsing history and passwords.

    • Adds Run key to start application

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v6

Tasks