General

  • Target

    17b07c4b4f7bf58c0eaf82eda4194ef1

  • Size

    648KB

  • Sample

    220818-janx4sbben

  • MD5

    17b07c4b4f7bf58c0eaf82eda4194ef1

  • SHA1

    f4394c1aa83a446829de15d519899962cdaf3e68

  • SHA256

    c1ffbd89a550c5c4f03d5a595efca82943336d0fd2b6b7592252d7cc18389628

  • SHA512

    0eae75405a4c4c0ceaa1947b9e66c86d50c3e86ce27b20c44abffdd182303a0afea7c595baea09aee41cd4028bf77892fc3ba9b08d22519129aa0c194109a328

  • SSDEEP

    12288:yXujmSxs9yVDQkuLN83a+HvY4AnOxFYggdRiXyqlp5U0VGSZs:9EgDV6AHZjgqjVGSG

Malware Config

Extracted

Family

azorult

C2

http://195.245.112.115/index.php

Targets

    • Target

      17b07c4b4f7bf58c0eaf82eda4194ef1

    • Size

      648KB

    • MD5

      17b07c4b4f7bf58c0eaf82eda4194ef1

    • SHA1

      f4394c1aa83a446829de15d519899962cdaf3e68

    • SHA256

      c1ffbd89a550c5c4f03d5a595efca82943336d0fd2b6b7592252d7cc18389628

    • SHA512

      0eae75405a4c4c0ceaa1947b9e66c86d50c3e86ce27b20c44abffdd182303a0afea7c595baea09aee41cd4028bf77892fc3ba9b08d22519129aa0c194109a328

    • SSDEEP

      12288:yXujmSxs9yVDQkuLN83a+HvY4AnOxFYggdRiXyqlp5U0VGSZs:9EgDV6AHZjgqjVGSG

    • Azorult

      An information stealer that was first discovered in 2016, targeting browsing history and passwords.

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v6

Tasks