General
-
Target
gunzipped.exe
-
Size
281KB
-
Sample
230406-kywhjaec3y
-
MD5
7da920add2788969e2609a186befd5bd
-
SHA1
dda9eabbd289b40bc4db72dc8391f60bb9cd9bce
-
SHA256
84e1b57a5d12513c002cc4a414919d43d98887feaa25288703f6e322617d4d8a
-
SHA512
38222444e926eaf66e8022a860dba6118403bed18244e364ed4bde501a4dc447baf827a0454fed605bc0717d1afc6d07b492367f584217c769bbcbaeef910303
-
SSDEEP
3072:EGKIQLQf2bo7xC9XwskypgM6h3uQDkjBz45r7HAhwAPsUgYcRD4n/I4zArAGPma:5faWswY36h3xw45HsDs+IDV/
Static task
static1
Behavioral task
behavioral1
Sample
gunzipped.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
gunzipped.exe
Resource
win10v2004-20230220-en
Malware Config
Extracted
azorult
http://45.88.66.207/oxza/index.php
Targets
-
-
Target
gunzipped.exe
-
Size
281KB
-
MD5
7da920add2788969e2609a186befd5bd
-
SHA1
dda9eabbd289b40bc4db72dc8391f60bb9cd9bce
-
SHA256
84e1b57a5d12513c002cc4a414919d43d98887feaa25288703f6e322617d4d8a
-
SHA512
38222444e926eaf66e8022a860dba6118403bed18244e364ed4bde501a4dc447baf827a0454fed605bc0717d1afc6d07b492367f584217c769bbcbaeef910303
-
SSDEEP
3072:EGKIQLQf2bo7xC9XwskypgM6h3uQDkjBz45r7HAhwAPsUgYcRD4n/I4zArAGPma:5faWswY36h3xw45HsDs+IDV/
-
Azorult
An information stealer that was first discovered in 2016, targeting browsing history and passwords.
-
Deletes itself
-
Loads dropped DLL
-
Accesses Microsoft Outlook profiles
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-