General

  • Target

    bfc3146ce64530156d73b1a53796c293e305e31b2800ad4ed53436b24f8cefa3

  • Size

    1.3MB

  • Sample

    220731-km3sgahgam

  • MD5

    affb5b2a89b7104918862e2cd3264ca1

  • SHA1

    76c485fa335ccad6d3b6cbbb36f00879533678a2

  • SHA256

    bfc3146ce64530156d73b1a53796c293e305e31b2800ad4ed53436b24f8cefa3

  • SHA512

    0085f6f41180573c9b622fd531572fbc4107ae96151f80a6a03dd05a6e1c154a4dff8e562c91db178c60214d6f189c956be5791bd15bb5b565e0db39e3c8d0ed

Malware Config

Extracted

Family

azorult

C2

http://piontx.cf/jibv/index.php

Targets

    • Target

      bfc3146ce64530156d73b1a53796c293e305e31b2800ad4ed53436b24f8cefa3

    • Size

      1.3MB

    • MD5

      affb5b2a89b7104918862e2cd3264ca1

    • SHA1

      76c485fa335ccad6d3b6cbbb36f00879533678a2

    • SHA256

      bfc3146ce64530156d73b1a53796c293e305e31b2800ad4ed53436b24f8cefa3

    • SHA512

      0085f6f41180573c9b622fd531572fbc4107ae96151f80a6a03dd05a6e1c154a4dff8e562c91db178c60214d6f189c956be5791bd15bb5b565e0db39e3c8d0ed

    • Azorult

      An information stealer that was first discovered in 2016, targeting browsing history and passwords.

    • Adds Run key to start application

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v6

Tasks