General
-
Target
RFQ100622=CHEMICAL LIST.exe
-
Size
1.1MB
-
Sample
221006-g7rn6ageb8
-
MD5
1c031d66b5a66ca142b9a381cab0047d
-
SHA1
01d3f6d65f0ecb71ce95b214e035a8a44cfdc7a6
-
SHA256
ee67e5b674c7c18a528e6146cc3655d01aa943ad08f251119bdbc52d46001e78
-
SHA512
14db3538293fb5fbbc0fe3a0ddfabf686de031bc431204ad2b615b1d3e86fa63e5230fad390849051eb9b7b7674d96badc680f7fa9757820e9a45aab7eef3e00
-
SSDEEP
12288:SHlZzR/4veb3x0r4y83OCDDImltAWt3dtTPAJg6YMcIEtRdfIIv6nnjqKoe:O74veb2xYOCDDZltrpCdcrB6nnjqKoe
Static task
static1
Behavioral task
behavioral1
Sample
RFQ100622=CHEMICAL LIST.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
RFQ100622=CHEMICAL LIST.exe
Resource
win10v2004-20220812-en
Malware Config
Extracted
azorult
http://leig.shop/leig/index.php
Targets
-
-
Target
RFQ100622=CHEMICAL LIST.exe
-
Size
1.1MB
-
MD5
1c031d66b5a66ca142b9a381cab0047d
-
SHA1
01d3f6d65f0ecb71ce95b214e035a8a44cfdc7a6
-
SHA256
ee67e5b674c7c18a528e6146cc3655d01aa943ad08f251119bdbc52d46001e78
-
SHA512
14db3538293fb5fbbc0fe3a0ddfabf686de031bc431204ad2b615b1d3e86fa63e5230fad390849051eb9b7b7674d96badc680f7fa9757820e9a45aab7eef3e00
-
SSDEEP
12288:SHlZzR/4veb3x0r4y83OCDDImltAWt3dtTPAJg6YMcIEtRdfIIv6nnjqKoe:O74veb2xYOCDDZltrpCdcrB6nnjqKoe
-
Azorult
An information stealer that was first discovered in 2016, targeting browsing history and passwords.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Deletes itself
-
Loads dropped DLL
-
Accesses Microsoft Outlook profiles
-
Accesses cryptocurrency files/wallets, possible credential harvesting
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Suspicious use of SetThreadContext
-