General

  • Target

    fac941eefc8571e51aef69289b5903c4.zip

  • Size

    598KB

  • Sample

    220923-r9ahrshcb8

  • MD5

    b2ce1906bca53c2e27835cf5f5e60e34

  • SHA1

    d1833cc2ed2aeeecc2e58baedf5baa4b3bb8134b

  • SHA256

    559968d922fc5f58289c5c532faef14a89c2259b56fece4f204d5186342d4529

  • SHA512

    ea7aaf164c4b01b8c9ddbbf2b35cd2a94f1b377e2f6e1f36bdc1d6ebca677ae12e71c9735e6dfc873a442d05aedabd9588b55aaf8cc3f08d8da76bfa1f063749

  • SSDEEP

    12288:loanPon8/yf+pO3BuRMfNRFuBHejcpsQo84QfVViWaXNWwCzgfZa:lhnPojfXRuRJeQjiQ9V7aX0zgRa

Malware Config

Extracted

Family

azorult

C2

http://188.209.52.233/gate.php

Targets

    • Target

      a5bb96d731ef58cf17cc579578ab89c7c46f275982be8eb137ff64268dff1efc

    • Size

      616KB

    • MD5

      1833589c607ac469b174b2814369ce61

    • SHA1

      cf9f0075bab1121727670149313ad19b4bdd5329

    • SHA256

      a5bb96d731ef58cf17cc579578ab89c7c46f275982be8eb137ff64268dff1efc

    • SHA512

      66d1b289bb81468a12b105cfc6af6c3ca4ee5f8fdd784604b1153c78fbcd79313374aa29a1b5822d2c5d65df9cc06e43468d1b91c2037e5b0f162e9165d4cf93

    • SSDEEP

      12288:K+KCarVlx6yaKbODxUazPGQoK0dGM0mIf/NLOs9FWGVMD0Fg5X4Un:K+KCapKaUx0K4ILOEWGVMIi5X4Un

    • Azorult

      An information stealer that was first discovered in 2016, targeting browsing history and passwords.

    • Loads dropped DLL

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v6

Tasks