General

  • Target

    5ff0246425e2cb3dc8c25909c7e539002f40f3617be6dc7ee0596462bb5f263b

  • Size

    428KB

  • Sample

    220731-jt1e9agddl

  • MD5

    3ce1abada35ce277a90bdd6a387241a2

  • SHA1

    01738a474482e5f2eba0559cb59b5e0fd4ba8af6

  • SHA256

    5ff0246425e2cb3dc8c25909c7e539002f40f3617be6dc7ee0596462bb5f263b

  • SHA512

    085434a860c06af1314435e2ae993b933f3ccb1a92296c513268f402ebf9d4c58c72c291ddb29f1005d18d013bcade3a109136d45e2f4e7cac8a6b895ace212f

Malware Config

Extracted

Family

azorult

C2

http://bluecornerblog.tk/precious/32/index.php

Targets

    • Target

      5ff0246425e2cb3dc8c25909c7e539002f40f3617be6dc7ee0596462bb5f263b

    • Size

      428KB

    • MD5

      3ce1abada35ce277a90bdd6a387241a2

    • SHA1

      01738a474482e5f2eba0559cb59b5e0fd4ba8af6

    • SHA256

      5ff0246425e2cb3dc8c25909c7e539002f40f3617be6dc7ee0596462bb5f263b

    • SHA512

      085434a860c06af1314435e2ae993b933f3ccb1a92296c513268f402ebf9d4c58c72c291ddb29f1005d18d013bcade3a109136d45e2f4e7cac8a6b895ace212f

    • Azorult

      An information stealer that was first discovered in 2016, targeting browsing history and passwords.

    • Uses the VBS compiler for execution

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v6

Tasks