General
-
Target
Quote request,pdf.exe
-
Size
932KB
-
Sample
220926-dsgc4ahbf2
-
MD5
b88afd394118edcc103674f7b1520837
-
SHA1
4d85547a7e5bea8be811d4ff11b233cfbfb44a21
-
SHA256
49863fc152c9e84f36d28f4b11b8e011c68791beaa8974b50cccb7508f01e444
-
SHA512
1fa9fb6427ff78d88ec82bbfdd16d3870e78f68ec0bcea840dd5b9d7e956ae7fedd42f4913b154bb5b474e7a9267b748c8e9d2c5ff8b06fbe4ba7ade08c1f621
-
SSDEEP
12288:yVdTaPkXK2VWdCv+opvJhiwTzvq3svMmrjTDoeg8Xf6JYnoRaYwJw45xcSf+zUKL:62cP0PWndTjq2TE8Xf8YnoRf8w8xc0O
Static task
static1
Behavioral task
behavioral1
Sample
Quote request,pdf.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
Quote request,pdf.exe
Resource
win10v2004-20220901-en
Malware Config
Extracted
azorult
http://ble33n.shop/PL341/index.php
Targets
-
-
Target
Quote request,pdf.exe
-
Size
932KB
-
MD5
b88afd394118edcc103674f7b1520837
-
SHA1
4d85547a7e5bea8be811d4ff11b233cfbfb44a21
-
SHA256
49863fc152c9e84f36d28f4b11b8e011c68791beaa8974b50cccb7508f01e444
-
SHA512
1fa9fb6427ff78d88ec82bbfdd16d3870e78f68ec0bcea840dd5b9d7e956ae7fedd42f4913b154bb5b474e7a9267b748c8e9d2c5ff8b06fbe4ba7ade08c1f621
-
SSDEEP
12288:yVdTaPkXK2VWdCv+opvJhiwTzvq3svMmrjTDoeg8Xf6JYnoRaYwJw45xcSf+zUKL:62cP0PWndTjq2TE8Xf8YnoRf8w8xc0O
-
Azorult
An information stealer that was first discovered in 2016, targeting browsing history and passwords.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Deletes itself
-
Loads dropped DLL
-
Accesses Microsoft Outlook profiles
-
Accesses cryptocurrency files/wallets, possible credential harvesting
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Suspicious use of SetThreadContext
-