Overview

overview

10

Static

static

AZ_Scan_87291_pdf.js

windows7-x64

10

AZ_Scan_87291_pdf.js

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    AZ_Scan_87291_pdf.js

  • Size

    1KB

  • Sample

    220915-py23jaggfq

  • MD5

    1f60eb182eb8e331cf7631a3a8c3080e

  • SHA1

    6a0fc5ddc3490f6628674605cb70b8e6178929d9

  • SHA256

    b16ff5477ed1e60e82a495a3b7cbe42371243670be0250f3f05d49a6ea37a4d3

  • SHA512

    242597d3662454364a776588356cc1e796e050b6770414ac045b8574602a78f71e1755ee4d0b20530dbfabf28b007b6a751c738aa36d7b3928794797307d6c89

Score
10/10
azorultcollectioninfostealerspywarestealertrojan

Malware Config

Extracted

Family

azorult

C2

http://185.29.9.47/aristo/Panel/index.php

Targets

    • Target

      AZ_Scan_87291_pdf.js

    • Size

      1KB

    • MD5

      1f60eb182eb8e331cf7631a3a8c3080e

    • SHA1

      6a0fc5ddc3490f6628674605cb70b8e6178929d9

    • SHA256

      b16ff5477ed1e60e82a495a3b7cbe42371243670be0250f3f05d49a6ea37a4d3

    • SHA512

      242597d3662454364a776588356cc1e796e050b6770414ac045b8574602a78f71e1755ee4d0b20530dbfabf28b007b6a751c738aa36d7b3928794797307d6c89

    Score
    10/10
    azorultcollectioninfostealerspywarestealertrojan

    • Azorult

      An information stealer that was first discovered in 2016, targeting browsing history and passwords.

      trojaninfostealerazorult

    • Blocklisted process makes network request

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Loads dropped DLL

    • Reads local data of messenger clients

      Infostealers often target stored data of messaging applications, which can include saved credentials and account information.

      spywarestealer

    • Accesses Microsoft Outlook profiles

      collection

    • Accesses cryptocurrency files/wallets, possible credential harvesting

      spyware

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

1
T1112

Credential Access

Credentials in Files

2
T1081

Discovery

Query Registry

2
T1012

System Information Discovery

3
T1082

Lateral Movement

Collection

Data from Local System

2
T1005

Email Collection

1
T1114

Exfiltration

Command and Control

Impact

Tasks