General
-
Target
8069426415.zip
-
Size
314KB
-
Sample
220929-w1pzbacfam
-
MD5
2db40a8706032e0e2db374453f76c72d
-
SHA1
13854ccebb5dec4b5548efb42a878570d08a9224
-
SHA256
f3cadeda58a11f36950dcb031a6e59762a4aa30595c59339f95be5397184f496
-
SHA512
9e9b9bb2ff5fdf0970255406e309e3572d096819e9813665be3791e959d66a67e2c0343ef86cd350478bdbe5d1ed4adb578ee42e1f6c0472db27f243d71e78e9
-
SSDEEP
6144:dXlcOwZIzgDr8EQKrCYE1zba0zA9zWxaMJEEEgMP4ymszf+xzh8/:dVc1ZMg0ELM1va0sWTBEgMPD2I/
Static task
static1
Behavioral task
behavioral1
Sample
7deebb0efb9f239c8dfd28c276738d377118d3d0a24bdb0b856821b1416f2710.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
7deebb0efb9f239c8dfd28c276738d377118d3d0a24bdb0b856821b1416f2710.exe
Resource
win10v2004-20220812-en
Malware Config
Extracted
azorult
http://85.31.46.24/cxzx/index.php
Targets
-
-
Target
7deebb0efb9f239c8dfd28c276738d377118d3d0a24bdb0b856821b1416f2710
-
Size
502KB
-
MD5
7468b7ea3ef3a77f8bdced438d7ad613
-
SHA1
0cc34e6e7ccacb6ddc1631cb5b9ac701a47e4387
-
SHA256
7deebb0efb9f239c8dfd28c276738d377118d3d0a24bdb0b856821b1416f2710
-
SHA512
503614235f6e85a13c232dcf309e2046caeff90253812bb22d5f7349b0027d6bf966749fe380f0077dd38ae834d37e6abe198ab25501aeaadb54e14346350233
-
SSDEEP
12288:+5sJ8mfqKtmO62/WJbjAXovDUJN7kE10n8:+sSbKwOzSk4vDoNn/
-
Azorult
An information stealer that was first discovered in 2016, targeting browsing history and passwords.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Deletes itself
-
Loads dropped DLL
-
Accesses Microsoft Outlook profiles
-
Accesses cryptocurrency files/wallets, possible credential harvesting
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Suspicious use of SetThreadContext
-