General

  • Target

    61305e9bf5a8551a94b407e579797b590b5c8ea1e78a3936f2dbc76dacfe32a5

  • Size

    787KB

  • Sample

    220731-hes7ysdaa5

  • MD5

    c952cfb9862d58fde136954569e1a972

  • SHA1

    5819ab482ec5bb0a077617e262bc9bf100294830

  • SHA256

    61305e9bf5a8551a94b407e579797b590b5c8ea1e78a3936f2dbc76dacfe32a5

  • SHA512

    f480d4f7c01fe34d194b3d3f1f67b69e8d738bd3f1e99a742280f561807e386a4bd9ceed08c926250c27e3e22c1494ef3c416458a05ed25119189c4307af1b0e

Malware Config

Extracted

Family

azorult

C2

http://uzoma.ru/db2/3.3/index.php

Targets

    • Target

      61305e9bf5a8551a94b407e579797b590b5c8ea1e78a3936f2dbc76dacfe32a5

    • Size

      787KB

    • MD5

      c952cfb9862d58fde136954569e1a972

    • SHA1

      5819ab482ec5bb0a077617e262bc9bf100294830

    • SHA256

      61305e9bf5a8551a94b407e579797b590b5c8ea1e78a3936f2dbc76dacfe32a5

    • SHA512

      f480d4f7c01fe34d194b3d3f1f67b69e8d738bd3f1e99a742280f561807e386a4bd9ceed08c926250c27e3e22c1494ef3c416458a05ed25119189c4307af1b0e

    • Azorult

      An information stealer that was first discovered in 2016, targeting browsing history and passwords.

    • Executes dropped EXE

    • Deletes itself

    • Loads dropped DLL

    • Suspicious use of SetThreadContext

MITRE ATT&CK Matrix

Tasks