General

  • Target

    f168aeb37f55586709411c882ce34166905cf469c92d5535ea2c3fa5f24fc895

  • Size

    294KB

  • Sample

    220731-hdx5hschf8

  • MD5

    a0e3b3cde4257e36a6f9c1ad30954b41

  • SHA1

    fde540bd802143b4876ea346e5604936f62d4a93

  • SHA256

    f168aeb37f55586709411c882ce34166905cf469c92d5535ea2c3fa5f24fc895

  • SHA512

    626cdf5a79190800d4afbd74e754cd085e62946dea42c5dcc49d37f1a4fef1d7d0a1098bd7b48e8550e71baf5f8f279cb54dc7c3b3c4d18967482debec585470

Malware Config

Extracted

Family

azorult

C2

http://uzoma.ru/db2/3.3/index.php

Targets

    • Target

      f168aeb37f55586709411c882ce34166905cf469c92d5535ea2c3fa5f24fc895

    • Size

      294KB

    • MD5

      a0e3b3cde4257e36a6f9c1ad30954b41

    • SHA1

      fde540bd802143b4876ea346e5604936f62d4a93

    • SHA256

      f168aeb37f55586709411c882ce34166905cf469c92d5535ea2c3fa5f24fc895

    • SHA512

      626cdf5a79190800d4afbd74e754cd085e62946dea42c5dcc49d37f1a4fef1d7d0a1098bd7b48e8550e71baf5f8f279cb54dc7c3b3c4d18967482debec585470

    • Azorult

      An information stealer that was first discovered in 2016, targeting browsing history and passwords.

    • Executes dropped EXE

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

    • Deletes itself

    • Loads dropped DLL

    • Suspicious use of SetThreadContext

MITRE ATT&CK Matrix

Tasks