Overview

overview

10

Static

static

10

AU3_EXE.exe

windows7-x64

10

AU3_EXE.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    AU3_EXE.exe

  • Size

    112KB

  • Sample

    220808-q9xgvsbeer

  • MD5

    30bd4415b8698b02c6e39bd8f5343115

  • SHA1

    3541170096377e396d8991c0dbc128680e7365fd

  • SHA256

    46e43f0806085da66f4d9bcb7391a618977f5f9a0c6b612e2e02ba6b8e9d1011

  • SHA512

    f5cb883f0cee38600ebb0a8800bff8e0ef952dd63da27236d2c8e11478026a69296105e4bcaeb23141601126e017c3b21872542bd67a45d5b5d57b0a2eb263f5

Score
10/10
azorultdiscoveryinfostealerspywarestealertrojan

Malware Config

Extracted

Family

azorult

C2

http://178.140.137.201/twitchyoutube/fk32nOPxf/index.php

Targets

    • Target

      AU3_EXE.exe

    • Size

      112KB

    • MD5

      30bd4415b8698b02c6e39bd8f5343115

    • SHA1

      3541170096377e396d8991c0dbc128680e7365fd

    • SHA256

      46e43f0806085da66f4d9bcb7391a618977f5f9a0c6b612e2e02ba6b8e9d1011

    • SHA512

      f5cb883f0cee38600ebb0a8800bff8e0ef952dd63da27236d2c8e11478026a69296105e4bcaeb23141601126e017c3b21872542bd67a45d5b5d57b0a2eb263f5

    Score
    10/10
    azorultdiscoveryinfostealerspywarestealertrojan

    • Azorult

      An information stealer that was first discovered in 2016, targeting browsing history and passwords.

      trojaninfostealerazorult

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Accesses 2FA software files, possible credential harvesting

      spywarestealer

    • Accesses cryptocurrency files/wallets, possible credential harvesting

      spyware

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery
    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

3
T1081

Discovery

Query Registry

2
T1012

System Information Discovery

1
T1082

Lateral Movement

Collection

Data from Local System

3
T1005

Exfiltration

Command and Control

Impact

Tasks