Overview

overview

10

Static

static

e555fe3baa...12.exe

windows7-x64

10

e555fe3baa...12.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    e555fe3baa7d282f00cdaccf6ce2820d9fdc6556f8f24d69971c30bf06bd3812

  • Size

    916KB

  • Sample

    221128-d1xeaafe8x

  • MD5

    265c40c81aaaa10357a8067f77d38bc6

  • SHA1

    ab5e6329bc4e04e97ad606a0d68d30f05dc63792

  • SHA256

    3574579c02573ca458ffd3960aa2f208f7aef699697fd08bd3ec0b1626e09300

  • SHA512

    8790b8e8d06cae8ad0beffd71483b7ee67e05fd3ff44edc873778869a86f6d3adab98f352f318bc962714befe86650905ddf723f86fd7ccf73675cbc7e03c779

  • SSDEEP

    12288:74Y/JhNXVMu1SIXsANm/rG21XA8/q8Y70gGChyGOOHQLtqemyApEzvva8b54M:xRhViu1SIXs6mjtD/V3gGWycHuqNEvv/

Score
10/10
azorultdiscoveryinfostealerpersistencetrojan

Malware Config

Extracted

Family

azorult

C2

http://195.245.112.115/index.php

Targets

    • Target

      e555fe3baa7d282f00cdaccf6ce2820d9fdc6556f8f24d69971c30bf06bd3812

    • Size

      926KB

    • MD5

      4467e7453190102f1ddf728c72a3d0e4

    • SHA1

      f2411a909ad01d078cbdfa1fda252eff18251e24

    • SHA256

      e555fe3baa7d282f00cdaccf6ce2820d9fdc6556f8f24d69971c30bf06bd3812

    • SHA512

      7f9cefe01955c63dd765e87591380dea26a97929356f2f9c0aac65b72972ce65f3260895f8a8b6539e421695113c3c725a7da8bbae78181f009f4f138675f510

    • SSDEEP

      24576:QxVRhRuu1SI/semBc3+y7LgG+KbSVU5ro:E1dwc3lLb+y

    Score
    10/10
    azorultdiscoveryinfostealerpersistencetrojan

    • Azorult

      An information stealer that was first discovered in 2016, targeting browsing history and passwords.

      trojaninfostealerazorult

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1
T1060

Privilege Escalation

Defense Evasion

Modify Registry

1
T1112

Credential Access

Discovery

Query Registry

3
T1012

System Information Discovery

3
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks