azorult | dcc410a5a4caecdc8ff2d863df50fae3adec46f391b50705e2f4ee59235d7af3 | Triage

Sharing

General

Target

RfQ urgente_AP65425652_032421.exe
Size

426KB
Sample

221003-g4x2rscfgm
MD5

41f1ae227bcf937eb3503819f5fbeebd
SHA1

c73f5ec3b1fdc30867763f413e0646a53f5d7503
SHA256

dcc410a5a4caecdc8ff2d863df50fae3adec46f391b50705e2f4ee59235d7af3
SHA512

b065fc4f56fdf388231a3b8e23e60ca15371c0a775aef90608e5dc419a46b1a2041c1e56bd1bf568bc3ff4623a8316d2bc1f590e55c78e72568f63f4d087b4eb
SSDEEP

6144:ATouKrWBEu3/Z2lpGDHU3ykJkUDmC/21qnbaItq+1mxwYeqgmaf:AToPWBv/cpGrU3yFUiG2MzBSwx

Score

10^/10

azorult infostealer trojan

Malware Config

Targets

- Target
  
  RfQ urgente_AP65425652_032421.exe
- Size
  
  426KB
- MD5
  
  41f1ae227bcf937eb3503819f5fbeebd
- SHA1
  
  c73f5ec3b1fdc30867763f413e0646a53f5d7503
- SHA256
  
  dcc410a5a4caecdc8ff2d863df50fae3adec46f391b50705e2f4ee59235d7af3
- SHA512
  
  b065fc4f56fdf388231a3b8e23e60ca15371c0a775aef90608e5dc419a46b1a2041c1e56bd1bf568bc3ff4623a8316d2bc1f590e55c78e72568f63f4d087b4eb
- SSDEEP
  
  6144:ATouKrWBEu3/Z2lpGDHU3ykJkUDmC/21qnbaItq+1mxwYeqgmaf:AToPWBv/cpGrU3yFUiG2MzBSwx
Score

10^/10

azorult infostealer trojan
- Azorult
  An information stealer that was first discovered in 2016, targeting browsing history and passwords.
  trojan infostealer azorult
- Executes dropped EXE
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Loads dropped DLL
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks

static1

behavioral1

azorultinfostealertrojan

behavioral2

azorultinfostealertrojan