General

  • Target

    c09de1c6cc204f239312a31aa81d7a98.exe

  • Size

    190KB

  • Sample

    230312-bc68gacb38

  • MD5

    c09de1c6cc204f239312a31aa81d7a98

  • SHA1

    218907e3e3453902cae6ef266d80f802a3e78907

  • SHA256

    c7930d104f9f1e522835dcbd6aecd707b6bdc27ec4f34149d32b90978e4a6878

  • SHA512

    e823ca4b4d92f3d00228d78072cde833acc44a038c4e41e10a1e6e28b700960b461fa98425131e24abb840b0be2a6492b2b9ec9e6d3140ea6b0a7b45532d964f

  • SSDEEP

    3072:tfY/TU9fE9PEtuysbYwD/uaoCXvmSlLDNf39RwFimTz9Gxs7rWaN47cj+5GT5csD:RYa6fd1HNfzwFimH37ysz+Yd9D

Malware Config

Extracted

Family

azorult

C2

http://85.31.45.29/ongod/index.php

Targets

    • Target

      c09de1c6cc204f239312a31aa81d7a98.exe

    • Size

      190KB

    • MD5

      c09de1c6cc204f239312a31aa81d7a98

    • SHA1

      218907e3e3453902cae6ef266d80f802a3e78907

    • SHA256

      c7930d104f9f1e522835dcbd6aecd707b6bdc27ec4f34149d32b90978e4a6878

    • SHA512

      e823ca4b4d92f3d00228d78072cde833acc44a038c4e41e10a1e6e28b700960b461fa98425131e24abb840b0be2a6492b2b9ec9e6d3140ea6b0a7b45532d964f

    • SSDEEP

      3072:tfY/TU9fE9PEtuysbYwD/uaoCXvmSlLDNf39RwFimTz9Gxs7rWaN47cj+5GT5csD:RYa6fd1HNfzwFimH37ysz+Yd9D

    • Azorult

      An information stealer that was first discovered in 2016, targeting browsing history and passwords.

    • Executes dropped EXE

    • Loads dropped DLL

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v6

Tasks