General

  • Target

    6018a1030bfe7890c016ccfd9d7f233e7109fb54974272fabea065b243a1853d

  • Size

    767KB

  • Sample

    220731-htmzgsefbj

  • MD5

    e559254e91867aace2c523eb0077f49c

  • SHA1

    b23c0e718fc7f595cefcafa8d7d4ebf9c7fb53ac

  • SHA256

    6018a1030bfe7890c016ccfd9d7f233e7109fb54974272fabea065b243a1853d

  • SHA512

    f4a5a00e330832a523957128064bf7c5233fde389284f65bcc7efb6cffd672fb97d4fe6981f81b728adc80150719efdb67856e48accd5f5d4350b5e9aa02695d

Malware Config

Extracted

Family

azorult

C2

http://projectkanor.bit/az/index.php

Targets

    • Target

      6018a1030bfe7890c016ccfd9d7f233e7109fb54974272fabea065b243a1853d

    • Size

      767KB

    • MD5

      e559254e91867aace2c523eb0077f49c

    • SHA1

      b23c0e718fc7f595cefcafa8d7d4ebf9c7fb53ac

    • SHA256

      6018a1030bfe7890c016ccfd9d7f233e7109fb54974272fabea065b243a1853d

    • SHA512

      f4a5a00e330832a523957128064bf7c5233fde389284f65bcc7efb6cffd672fb97d4fe6981f81b728adc80150719efdb67856e48accd5f5d4350b5e9aa02695d

    • Azorult

      An information stealer that was first discovered in 2016, targeting browsing history and passwords.

    • Unexpected DNS network traffic destination

      Network traffic to other servers than the configured DNS servers was detected on the DNS port.

    • Suspicious use of SetThreadContext

MITRE ATT&CK Matrix

Tasks