General
-
Target
Orden de Compra.pdf.exe
-
Size
515KB
-
Sample
230412-j3tztscd9x
-
MD5
f143a0acbeb1b1a569256220a560a753
-
SHA1
15b3c9768a67ce0d09807627f1939c7165a3fede
-
SHA256
0239bc35516d6d3680c64f7a5a5a40801c7b0ea4db8a80718e4774687c565af3
-
SHA512
b438f760d0e22e07866fd5b49642a2cc04475ec7ae8888643985bda8532f30a234f30883d55922d204610b2f6096a0783af922eb7e0ed580a09dc8f6825bb6aa
-
SSDEEP
12288:B2iNt0AwD4YfotOWRAZ3jyGb/OuvwsLnwG45tYgaGL:B1CWR03xNw1bYgaGL
Static task
static1
Behavioral task
behavioral1
Sample
Orden de Compra.pdf.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
Orden de Compra.pdf.exe
Resource
win10v2004-20230220-en
Malware Config
Extracted
azorult
http://171.22.30.164/smith/index.php
Targets
-
-
Target
Orden de Compra.pdf.exe
-
Size
515KB
-
MD5
f143a0acbeb1b1a569256220a560a753
-
SHA1
15b3c9768a67ce0d09807627f1939c7165a3fede
-
SHA256
0239bc35516d6d3680c64f7a5a5a40801c7b0ea4db8a80718e4774687c565af3
-
SHA512
b438f760d0e22e07866fd5b49642a2cc04475ec7ae8888643985bda8532f30a234f30883d55922d204610b2f6096a0783af922eb7e0ed580a09dc8f6825bb6aa
-
SSDEEP
12288:B2iNt0AwD4YfotOWRAZ3jyGb/OuvwsLnwG45tYgaGL:B1CWR03xNw1bYgaGL
-
Azorult
An information stealer that was first discovered in 2016, targeting browsing history and passwords.
-
Loads dropped DLL
-
Accesses Microsoft Outlook profiles
-
Accesses cryptocurrency files/wallets, possible credential harvesting
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Suspicious use of SetThreadContext
-