General

  • Target

    cc737cd4185a6c2e189cd2d3fc4641c61355efe2713f7ec6ae93062e871ac947

  • Size

    973KB

  • Sample

    220731-hpnp8aedbj

  • MD5

    7f75b6d9e7cc78a66e006af4390adfd6

  • SHA1

    733bb038bf780603d09ca069a4bae4d2dfeee8e4

  • SHA256

    cc737cd4185a6c2e189cd2d3fc4641c61355efe2713f7ec6ae93062e871ac947

  • SHA512

    c823313dfd323c23b927a365f41befc3d8fe833e35f6e6afe9ee4039cac074e3c9a7a3b8b85c634d293a3c97f1e30064bb1898d2ba1ab26cd4ca3838cdd38518

Malware Config

Extracted

Family

azorult

C2

http://cloneblood.tk/bin/32/index.php

Targets

    • Target

      cc737cd4185a6c2e189cd2d3fc4641c61355efe2713f7ec6ae93062e871ac947

    • Size

      973KB

    • MD5

      7f75b6d9e7cc78a66e006af4390adfd6

    • SHA1

      733bb038bf780603d09ca069a4bae4d2dfeee8e4

    • SHA256

      cc737cd4185a6c2e189cd2d3fc4641c61355efe2713f7ec6ae93062e871ac947

    • SHA512

      c823313dfd323c23b927a365f41befc3d8fe833e35f6e6afe9ee4039cac074e3c9a7a3b8b85c634d293a3c97f1e30064bb1898d2ba1ab26cd4ca3838cdd38518

    • Azorult

      An information stealer that was first discovered in 2016, targeting browsing history and passwords.

    • Uses the VBS compiler for execution

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v6

Tasks