Overview

overview

10

Static

static

e555fe3baa...24.exe

windows7-x64

10

e555fe3baa...24.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    e555fe3baa7d282f00cdaccf6ce2820d9fdc6556f8f24.exe

  • Size

    926KB

  • Sample

    221126-t1c9eagf64

  • MD5

    4467e7453190102f1ddf728c72a3d0e4

  • SHA1

    f2411a909ad01d078cbdfa1fda252eff18251e24

  • SHA256

    e555fe3baa7d282f00cdaccf6ce2820d9fdc6556f8f24d69971c30bf06bd3812

  • SHA512

    7f9cefe01955c63dd765e87591380dea26a97929356f2f9c0aac65b72972ce65f3260895f8a8b6539e421695113c3c725a7da8bbae78181f009f4f138675f510

  • SSDEEP

    24576:QxVRhRuu1SI/semBc3+y7LgG+KbSVU5ro:E1dwc3lLb+y

Score
10/10
azorultdiscoveryinfostealerpersistencetrojan

Malware Config

Extracted

Family

azorult

C2

http://195.245.112.115/index.php

Targets

    • Target

      e555fe3baa7d282f00cdaccf6ce2820d9fdc6556f8f24.exe

    • Size

      926KB

    • MD5

      4467e7453190102f1ddf728c72a3d0e4

    • SHA1

      f2411a909ad01d078cbdfa1fda252eff18251e24

    • SHA256

      e555fe3baa7d282f00cdaccf6ce2820d9fdc6556f8f24d69971c30bf06bd3812

    • SHA512

      7f9cefe01955c63dd765e87591380dea26a97929356f2f9c0aac65b72972ce65f3260895f8a8b6539e421695113c3c725a7da8bbae78181f009f4f138675f510

    • SSDEEP

      24576:QxVRhRuu1SI/semBc3+y7LgG+KbSVU5ro:E1dwc3lLb+y

    Score
    10/10
    azorultdiscoveryinfostealerpersistencetrojan

    • Azorult

      An information stealer that was first discovered in 2016, targeting browsing history and passwords.

      trojaninfostealerazorult

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1
T1060

Privilege Escalation

Defense Evasion

Modify Registry

1
T1112

Credential Access

Discovery

Query Registry

3
T1012

System Information Discovery

3
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks