General

  • Target

    60187f056167cf2f951a8a9302e312ff9e83cafbf6ae7d436e3db1646b8b092b

  • Size

    3.3MB

  • Sample

    220731-htsvqsdfg5

  • MD5

    fb46fcac2d17b14c30e8d68a0f0a0023

  • SHA1

    2e1d44ac241843f02b7b190902928e1acce27d4c

  • SHA256

    60187f056167cf2f951a8a9302e312ff9e83cafbf6ae7d436e3db1646b8b092b

  • SHA512

    e6e7ed6be686a0ef9a6d1e6f930a88260fd8c27cf06aea51934efc027bec75d2066b7ab8b95b9ed8f7a6cf0bd98cbe7a3a15e87c9cf464ac404b3d04196f9dfb

Malware Config

Extracted

Family

azorult

C2

http://licilucapiluca.rocks/index.php

Targets

    • Target

      60187f056167cf2f951a8a9302e312ff9e83cafbf6ae7d436e3db1646b8b092b

    • Size

      3.3MB

    • MD5

      fb46fcac2d17b14c30e8d68a0f0a0023

    • SHA1

      2e1d44ac241843f02b7b190902928e1acce27d4c

    • SHA256

      60187f056167cf2f951a8a9302e312ff9e83cafbf6ae7d436e3db1646b8b092b

    • SHA512

      e6e7ed6be686a0ef9a6d1e6f930a88260fd8c27cf06aea51934efc027bec75d2066b7ab8b95b9ed8f7a6cf0bd98cbe7a3a15e87c9cf464ac404b3d04196f9dfb

    • Azorult

      An information stealer that was first discovered in 2016, targeting browsing history and passwords.

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Loads dropped DLL

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

MITRE ATT&CK Enterprise v6

Tasks