General
-
Target
gunzipped.exe
-
Size
559KB
-
Sample
220916-xzcs2ageb4
-
MD5
fcaca51b5c3d88c17091392663d0ac96
-
SHA1
5acf69b9fc895a6cee9743d4bd84f66231c3697f
-
SHA256
89c19a0a44b9c3335e77cfc61f3b52516b11fc7f6aa501f677fb6c37df86efbc
-
SHA512
a55965a83fe5fd2024361d0133b29bf0a41558b0a33aa42e75db1b1e7dd8fff2fb537828be42b3ae90858dfc32032b79c86fa2d0a90bef71d1d3baf903bb8bcb
-
SSDEEP
12288:beW2vm8lylSx1Tm9xkdbg8EMEjBUpkADqjJ5n:beW2vTm9x+U8qjmcjr
Static task
static1
Behavioral task
behavioral1
Sample
gunzipped.exe
Resource
win7-20220901-en
Behavioral task
behavioral2
Sample
gunzipped.exe
Resource
win10v2004-20220812-en
Malware Config
Extracted
azorult
http://167.71.90.81/index.php
Targets
-
-
Target
gunzipped.exe
-
Size
559KB
-
MD5
fcaca51b5c3d88c17091392663d0ac96
-
SHA1
5acf69b9fc895a6cee9743d4bd84f66231c3697f
-
SHA256
89c19a0a44b9c3335e77cfc61f3b52516b11fc7f6aa501f677fb6c37df86efbc
-
SHA512
a55965a83fe5fd2024361d0133b29bf0a41558b0a33aa42e75db1b1e7dd8fff2fb537828be42b3ae90858dfc32032b79c86fa2d0a90bef71d1d3baf903bb8bcb
-
SSDEEP
12288:beW2vm8lylSx1Tm9xkdbg8EMEjBUpkADqjJ5n:beW2vTm9x+U8qjmcjr
-
Azorult
An information stealer that was first discovered in 2016, targeting browsing history and passwords.
-
Loads dropped DLL
-
Accesses Microsoft Outlook profiles
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Suspicious use of SetThreadContext
-